testing/certutil/cmd: add passphrase protected key support

[AndersonQ]

What does this PR do?

Add support to generate certificates with passphrase protected keys. It adds the --pass CLI flag, when passed, it'll generate a passphrase protected key and also save the key to disk.

It also adds the --prefix CLI flag, which value will prefix the files saved to disk. If not passed, it defaults to the current timestamp

Why is it important?

• It allows to use certutil for tests where the certificate key needs to be passphrase protected
• the prefix facilitates to organise and move/copy/delete the files

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• ~~[ ] I have added tests that prove my fix is effective or that my feature works

How to test this PR:

• generate certificates:

go run main.go --prefix server --pass server --ips 10.80.40.162,127.0.0.1

you should have

-rw------- 1 ainsoph ainsoph  288 Sep 20 18:25 server-ca_key.pem
-rw------- 1 ainsoph ainsoph  904 Sep 20 18:25 server-ca.pem
-rw------- 1 ainsoph ainsoph  399 Sep 20 18:25 server-localhost_enc-key.pem
-rw------- 1 ainsoph ainsoph  288 Sep 20 18:25 server-localhost_key.pem
-rw------- 1 ainsoph ainsoph    6 Sep 20 18:25 server-localhost-passphrase
-rw------- 1 ainsoph ainsoph  916 Sep 20 18:25 server-localhost.pem

• validate the server sertificate

$openssl verify -verbose  --show_chain -CAfile ./server-ca.pem server-localhost.pem

server-localhost.pem: OK
Chain:
depth=0: L = anywhere in time and space, O = TARDIS, CN = Police Public Call Box (untrusted)
depth=1: C = Gallifrey, L = The Capitol, O = High Council of the Time Lords, OU = Time Lords, CN = High Council

Related issues

• Relates Pass the decrypted mTLS client certificate key to Elastic Defend elastic-agent#5490

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a1e3871

cc @AndersonQ

[mauri870]

LGTM, tested locally and was able to generate the keys and validate that it is password protected with openssl pkey -in server-localhost_enc-key.pem.