Reading CRL from Vault CLI as DER may output an invalid CRL file

**Describe the bug**
We've observed that the result from Vault CLI's `vault read -format=raw {pki}/issuer/{issuer_id}/crl/der` can produce an invalid CRL file from one rotation of CRLs to another.
However, it's consistent within one rotation -> If the CRL is invalid once, calling again `vault read` will always be invalid until the next rotation, which may or may not fix it.

By "invalid", I mean that reading it through `openssl crl -inform DER -text -noout -in ` fails with `Could not find CRL from `.
The file itself seems almost correct, but missing a few bytes (see additional context).

The equivalent `/crl/pem` from Vault's CLI consistently works.
Same goes for `/crl/der` and `/crl/pem` on the HTTP API.
Worse, the pem to der transformation of the result of `/crl/der` works without issues with openssl (`openssl crl -outform der -in -out ` and then `openssl crl -inform DER -text -noout -in `).

**To Reproduce**
I'll attach a script that reproduces the issue. It creates a simple PKI, and then loops on a CRL rotation + read CRL until it finds an error.

[start_minimal_vault.sh](https://github.com/user-attachments/files/29470885/start_minimal_vault.sh)

**Expected behavior**
I'm expecting Vault CLI's `/crl/der` to behave the same as its counterparts and render a consistent result that can be read by other tools.

**Environment:**
* Vault Server Version (retrieve with `vault status`): 2.0.0 and 2.0.3 -> tried both version, the original issue definitely occurred on an earlier version, though I can't know which one
* Vault CLI Version (retrieve with `vault version`): 2.0.0 and 2.0.3
* Server Operating System/Architecture: Ubuntu 24.04 (using Nix's Vault)

Vault server configuration file(s): Everything's in the script attached.

```hcl
# Paste your Vault config here.
# Be sure to scrub any sensitive values
Everything's in the script attached
```

**Additional context**
- Originally, the issue was found while reading CRLs we generated some time ago, using rustls which failed to read such CRLs (same goes for x509_parser)
- The DER file that we get from `/crl/der` seems to vary in size after each rotation by a few bytes, and it's always when it's lower in size that it fails. I didn't go too deep in the actual bytes missing, as I'm lacking the skill to do so properly.

Start by running the attached start_minimal_vault.sh reproduction script, then validate the CLI's vault read -format=raw {pki}/issuer/{issuer_id}/crl/der output with openssl crl -inform DER -text -noout. Trace the Vault CLI handling of the /crl/der response and compare it with the HTTP API and /crl/pem paths. Done means repeated rotations produce DER files that OpenSSL can read consistently.

Written by the indexing model from the issue text.