feat(fips): certificate/PKI crypto detection (ring 2, ADR-004 follow-on)

[williaby]

Summary

Add certificate / PKI cryptographic detection to the PQC readiness tooling. This
is ring 2 of the scope defined in
ADR-004 and is the
immediate next ADR after it (ADR-005 candidate).

Why

ADR-004 scopes the current python-fips-compatibility work to Python source plus
the transport/dependency surface (ring 1). Certificates are entirely uncovered
today, yet PKI is the hardest and highest-stakes part of PQC migration: long-lived
roots and signature algorithms baked into trust chains. A "PQC readiness"
inventory that cannot answer "what signature algorithms are in our trust chain"
has a conspicuous hole.

Scope

• Detect committed certificate material (*.pem, *.crt, *.key) and
  cert-generating code.
• Report the signature algorithm (RSA / ECDSA / Ed25519) and key parameters, and
  classify quantum vulnerability.
• Emit findings into the shared CycloneDX 1.6 CBOM (assetType: certificate) so
  they merge into the same homelab-infra fleet dashboard as ring 1.

Design notes / constraints

• Needs an ASN.1 / x509 parser (e.g. cryptography.x509), NOT source regex.
  This is a new detection engine, not a rule addition to the existing checker.
• The surface is small and bounded (glob, parse, read the sig alg), which is why
  it is the highest value-per-effort expansion.
• Reuses the D2 (CBOM format) and D3 (aggregator/dashboard) contract established
  by ADR-004; certs are a new producer clipping onto a fixed consumer.

Acceptance

• ADR-005 drafted and accepted.
• Certificate crypto assets appear in per-repo CBOM and the fleet dashboard.