Consider deriving PKCS #11 public key from certificate

Currently PKCS#11 requires a public key to be token. Alternatively, the public key can be derived from the certificate, similar to the windows and macos implementations.

This would:

1. Reduce work. There is no reason to have the public key stored in the HSM, our use case only cares about the certificate.
1. Reduce mistakes. Most users of ECP will likely think a certificate and private key is enough. Extracting and loading the Public key is an awkward and extra step.