fix: read TPP's PkixParameterSet key-algorithm policy (25.1+)

[wallrj-cyberark]

Problem

From TPP 25.1 onwards, the Certificates/CheckPolicy endpoint no longer locks the deprecated KeyPair.KeyAlgorithm/KeySize/EllipticCurve fields when a policy folder's allowed key algorithms are configured via the newer AlgorithmSelector API. Instead, the allowed algorithms are expressed as a list of PKIX OIDs in KeyPair.PkixParameterSet.Values.

vcert has two independent consumers of this same CheckPolicy response, both of which only read the deprecated fields:

• pkg/venafi/tpp/tpp.go's serverPolicy.toPolicy(), used by ReadPolicyConfiguration/ReadZoneConfiguration to populate endpoint.Policy.AllowedKeyConfigurations — this is what a calling application (e.g. cert-manager's approver-policy Venafi plugin) uses to actually enforce policy.
• pkg/policy/policyUtils.go's BuildPolicySpecificationForTPP, used by the vcert getpolicy/setpolicy CLI commands to report/manage policy.

Both silently treated any TPP 25.1+ policy folder using the new PKIX mechanism as unrestricted: endpoint.Policy.AllowedKeyConfigurations ended up containing every supported RSA size and ECDSA curve, and vcert getpolicy reported no key type/size restriction under policy.keyPair at all — regardless of what the TPP administrator had actually configured.

Fix

• Adds a PkixParameterSet field to serverPolicy.KeyPair (pkg/venafi/tpp/tpp.go) and to KeyPairResponse (pkg/policy/policyStructures.go) to capture KeyPair.PkixParameterSet.Values from the CheckPolicy response in both code paths.
• Adds a shared reverse lookup table, policy.PkixToKeyAlgorithms (pkg/policy/policyUtils.go), mapping the PKIX OIDs (Venafi's IANA private enterprise arc, 1.3.6.1.4.1.28783...) back to key type/size/curve — the inverse of the existing forward mapping KeyAlgorithmsToPKIX, which is also extended to cover RSA 8192 (previously missing).
• serverPolicy.toPolicy() and BuildPolicySpecificationForTPP both now prefer KeyPair.PkixParameterSet.Values when locked, falling back to the deprecated KeyAlgorithm/KeySize/EllipticCurve fields for TPP versions before 25.1.
• Adds unit test coverage for both paths: TestConvertServerPolicyToInternalPolicy_PkixParameterSet (single/multiple RSA sizes, a single ECDSA curve, mixed RSA+ECDSA, the legacy fallback, an unrecognised-OID error) and TestBuildPolicySpecificationForTPPPkixParameterSet/...UnrecognisedOID.

Test evidence

Enforcement path (serverPolicy.toPolicy()): verified end-to-end against a live TPP 25.3 instance using our internal cert-manager approver-policy Venafi plugin's integration test suite, which calls this exact code path (ReadPolicyConfiguration/ReadZoneConfiguration → toPolicy()) to enforce key-type/size policy on CertificateRequests. Three integration subtests exercise this scenario against a policy folder locked to RSA 4096/8192 via the new PKIX mechanism — submitting an ECDSA key, an unsupported RSA size, and an RSA key below the locked minimum. Before this fix vcert silently allowed all three; consuming this branch via a go.mod replace, all three now correctly deny the request.

CLI path (BuildPolicySpecificationForTPP): verified live with vcert getpolicy against the same TPP 25.3 policy folder (locked to RSA 4096/8192 via PkixParameterSet). Before this fix:

"policy": { "keyPair": { "reuseAllowed": true } }

After this fix:

"policy": { "keyPair": { "keyTypes": ["RSA"], "rsaKeySizes": [4096, 8192], "reuseAllowed": true } }

Also ran go build ./..., go vet ./..., and the full pkg/policy unit test suite locally (all passing). pkg/venafi/tpp's own test suite requires live TPP test credentials not set up for this exact package's test harness, so it wasn't run directly here — the two live verifications above exercise the same code paths against a real server.