Allow CSRs to be created for encryption-only public keys (such as ML-KEM)

In relation to #15263, which allows ML-KEM public keys to be included in the subjectPublicKeyInfo field in X.509 certificates.

Certificate applicants will either use a CSR (RFC 2986) or a CRMF (RFC 4211) to provide their to-be-certified public key to the CA (among other information). Since ML-KEM (among others) cannot be used to create a digital signature, RFC 9883 has been published as solution.

While most of this RFC describes a procedure, the following items need be added to support this mechanism:

• Sign a CSR using a different private key than was included;
• Ability to add the statementOfPossession attribute to the CSR. I'd imagine extending the Attribute mechanism in a similar fashion as is done for Extension.