fix apiv5 openvpn cert and key configs
- Switch to PKCS8 encoding of ecdsa private keys to keep it aligned with ed25519 private keys. This fixes ecdsa key handling on Android clients
- Always return the PEM formatted root CA in api/5/openvpn/cert: see https://0xacab.org/leap/container-platform/lilypad/-/tree/main/config/roles/sspki - clients need the root CA to verify their openvpn session.