Private key parsing hardcodes RSA client certificates

[AlexandarNaydenovSAP]

Description

CertificateHttpClientConfig.parsePrivateKey hardcodes KeyFactory.getInstance("RSA"), so any
non-RSA client key fails to load and the application aborts on startup.

We do not use the BTP Certificate Service. When certificates are issued by another SAP service —
e.g. the Zero Trust Identity Service — the private key is EC (P-256), not RSA. The ALS
ingestion API accepts these certificates over mTLS, but the library cannot parse the key.

Affects both the unencrypted and encrypted key paths, in all released versions through 0.1.1.

Steps to reproduce

Bind the plugin with an ALS instance whose key/cert are EC (P-256, PKCS#8) — as issued by the
Zero Trust Identity Service — and start the CAP-Java app.

Actual behavior

c.s.c.f.a.n.CertificateHttpClientConfig : Failed to create HttpClient with certificate/key
java.security.InvalidKeyException: Invalid RSA private key
  Caused by: java.io.IOException: Version must be 0

The CdsRuntimeInitializer bean then fails and the app does not start.

Root cause

parsePrivateKey parses the PEM into a BouncyCastle PrivateKeyInfo (which carries the algorithm
OID) but discards it, forcing RSA:

PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyInfo.getEncoded());
return KeyFactory.getInstance("RSA").generatePrivate(keySpec);   // hardcoded RSA

An EC key spec fed into an RSA KeyFactory throws the error above.

Suggested fix

Use BouncyCastle's algorithm-agnostic converter (bcpkix-jdk18on is already a dependency), which
reads the algorithm from the key (RSA/EC/EdDSA):

import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;

return new JcaPEMKeyConverter().setProvider("BC").getPrivateKey(keyInfo);

Strict superset of current behavior — RSA keys still load. Verified locally that this lets
EC-keyed bindings start and deliver events. Happy to open a DCO-signed PR with the fix + an EC
regression test if you assign this to me.

Environment

• Plugin version: 0.1.1 (also reproduced on main)
• Key type: EC P-256, PKCS#8 (Zero Trust Identity Service)