fix: validate certificate public key encoding

[leanthebean]

Summary

Fixes CAT finding 8e9d6651-3110-4974-be61-b5f1db6f9206.

CertManager._parsePubKey previously assumed the SubjectPublicKeyInfo BIT STRING was the expected uncompressed P-384 point and sliced the last 96 bytes. A non-standard BIT STRING length could therefore cause the parser to cache bytes outside the intended (x,y) public key.

This change:

• requires the decoded BIT STRING payload to be exactly 97 bytes;
• requires the first payload byte to be the uncompressed EC point marker 0x04;
• slices the 96-byte P-384 public key from immediately after that marker;
• explicitly rejects truncated payloads before any public-key bytes are cached.

Self Review

Reviewed the final diff before opening this PR. The production change is scoped to _parsePubKey, preserves the valid AWS Nitro P-384 uncompressed point path, and rejects the malformed SPKI shapes from the finding instead of relying on downstream curve checks or raw slice bounds.

Tests

• forge test --match-path test/CertManager.t.sol -vvv
• forge test