cmd/scepclient: add -encryption-algo flag (DES-CBC/AES-128-CBC/AES-256-CBC)

[sleventyeleven]

Summary

scepclient currently hardcodes the SCEP PKIOperation request's CMS
EnvelopedData encryption to DES-CBC (smallstep/pkcs7's package-level
ContentEncryptionAlgorithm default), with no way to override it and no
GetCACaps-based negotiation for this choice.

Some SCEP servers reject DES-CBC outright. AWS Private CA's Connector for
SCEP returns ValidationException: Unsupported algorithm: 1.3.14.3.2.7
(the DES-CBC OID) for every enrollment attempt, making scepclient
currently unusable against it.

This adds a single new flag, -encryption-algo, accepting DES-CBC,
AES-128-CBC, or AES-256-CBC, defaulting to DES-CBC to preserve
existing behavior for any server that only supports it.

Testing

Verified against a real AWS Private CA Connector for SCEP deployment:

• Without this change (DES-CBC): every enrollment attempt fails with
  Unsupported algorithm: 1.3.14.3.2.7.
• With -encryption-algo AES-256-CBC: pkiStatus=SUCCESS, valid
  certificate issued and confirmed usable for TLS ClientAuth against a
  downstream mTLS-verifying service.

A temporary test build with this change (plus binaries for
windows/amd64, darwin/amd64, darwin/arm64) is available at
https://github.com/sleventyeleven/scep/releases/tag/v2.3.0-encryption-algo-test1
if useful for review.

Notes

• No behavior change for existing users - DES-CBC remains the default.
• Change is additive: one new flag, one new small pure function
  (parseEncryptionAlgorithm), and setting pkcs7.ContentEncryptionAlgorithm
  once during flag parsing in main().
• github.com/smallstep/pkcs7 was already an indirect dependency (via
  github.com/smallstep/scep); this adds it as an explicit direct
  go.mod requirement since it's now imported directly.

[sleventyeleven]

Closed because this is almost entirely redundant in use case and feature as PR #252