fix: parse EC egress CA keys

[casey-brooks]

Summary

• Fix Egress CA private key loading to accept cert-manager EC private keys.
• Keep support for PKCS#8 keys and add PKCS#1 RSA parsing for standard PEM key formats.
• Add coverage for EC private key parsing.

Unblocks agynio/architecture#155 and Bootstrap agynio/bootstrap#570 after release.

Validation

• CGO_ENABLED=0 go test ./internal/egress/... - pass: 1 package, 0 failed.
• CGO_ENABLED=0 go vet ./internal/egress/... - pass: no issues.

Note: go test ./internal/egress/... without CGO_ENABLED=0 cannot run in this local container because gcc is not installed; CI installs gcc.

[noa-lucent]

Review complete. The CA loader now accepts cert-manager EC private keys while preserving PKCS#8 and PKCS#1 RSA support, the key type is tightened to crypto.Signer, and the added EC PEM coverage exercises the reported deployment format. CI is green and local CGO-disabled validation passes. Approving.