fixes #12949 -- added support for decrypting des-cbc-md5 keys

[alex]

Implemented by Zed (claude sonnet 4) + a bit of cleanup by me with the following prompt:

Add support to the existing private key parsing APIs for decrypting keys that have the OID 1.2.840.113549.1.5.3. There's an existing vector you can add to our tests for this (documented in test-vectors.rst). You can run tests + formatters + linters with nox -e local

[Copilot]

Pull Request Overview

This PR fixes #12949 by adding support for decrypting private keys encrypted with the DES-CBC/MD5 PBE scheme. Key changes include:

• A new test case in the serialization tests for loading MD5/DES-CBC encrypted keys (with a FIPS skip marker).
• A new OID constant and a corresponding variant in the AlgorithmParameters enum to support PBE_WITH_MD5_AND_DES_CBC.
• Implementation of the pkcs5_pbe_decrypt function in the pkcs8 module and addition of a PBKDF1 function to support key derivation.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/hazmat/primitives/test_serialization.py	Added new test for PKCS#8 decryption using MD5 and DES-CBC with proper FIPS-compliance skipping.
src/rust/cryptography-x509/src/oid.rs	Defined a new constant for the PBE_WITH_MD5_AND_DES_CBC OID.
src/rust/cryptography-x509/src/common.rs	Extended the AlgorithmParameters enum and introduced a new PbeParams struct to support DES-CBC mode.
src/rust/cryptography-key-parsing/src/pkcs8.rs	Added the pkcs5_pbe_decrypt function and updated parse_encrypted_private_key to utilize it.
src/rust/cryptography-crypto/src/pbkdf1.rs	Implemented PBKDF1 as defined in RFC 2898 for PKCS#5 v1.5 PBE algorithms.

[alex]

sigh, our cipher_supported() check doesn't work because we turn the key into a triple des key, but only single des requires the legacy provider

we need some way to check if we have single des in the tests