Add full support for ECDSA roots

[aarongable]

Historically, minica has only been able to generate RSA root keypairs,
and has similarly only been able to load pre-existing PKCS1-formatted
RSA keys from disk.

This change adds support for ECDSA keypairs throughout minica's stack.
It now has a flag which allows users to select between RSA and ECDSA
when creating a new self-signed root. Its internal key generation is
now able to generate either RSA or ECDSA keys, and its key loading is
able to load both RSA and ECDSA keys. Finally, when saving keys to disk,
it now uses the PKCS8 format (which supports multiple kinds of keys)
instead of PKCS1, which only supports RSA. It similarly supports PKCS8
when loading keys from disk.

It still always generates an RSA keypair for the end-entity certificate it
issues.