[laasyapriya2007]

Closes #15313

Description

Adds CertificateSigningRequestBuilder.public_key(), which explicitly sets
the public key placed in the CSR's subjectPublicKeyInfo. This enables CSRs
for encryption-only public keys -- such as ML-KEM and X25519 -- which cannot
sign themselves, by signing the CSR with a different, signature-capable
private key, as described in RFC 9883.

• New public_key(key) setter on CertificateSigningRequestBuilder
  accepting any CertificatePublicKeyTypes (including MLKEM768PublicKey,
  MLKEM1024PublicKey, X25519PublicKey, and X448PublicKey).
• sign() now uses the explicitly supplied public key for the CSR's
  subjectPublicKeyInfo while the signature over the CertificationRequestInfo
  is computed with the signing private key. When no public key is set,
  behavior is unchanged: the SPKI is derived from private_key.public_key().
• In the Rust backend, create_x509_csr reads _public_key from the builder
  when present, mirroring how create_x509_certificate already handles
  CertificateBuilder._public_key.
• Tests cover an MLKEM768PublicKey CSR signed with an Ed25519PrivateKey
  and an X25519PublicKey CSR signed with an EC key -- asserting the CSR
  carries the supplied public key and round-trips through PEM and DER --
  plus setter validation and the default backward-compatible path.