sha256_fingerprint function tries to re-encode certificate which fails if the certificate is BER instead of DER

Some certificates are BER (or from a CMS structure that uses BER) and due to that do not fit into the subset of DER.

This will result in the following stacktrace when just trying to get a certificate fingerprint:

```rust
thread 'main' (30504) panicked at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/captured.rs:183:9:
Trying to encode a captured value with incompatible mode
stack backtrace:
0: std::panicking::begin_panic
at /rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb/library/std/src/panicking.rs:770:5
1: ::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/captured.rs:183:9
2: ::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-certificate-0.25.0/src/rfc5280.rs:148:16
3: <(T1,T0) as bcder::encode::values::Values>::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/encode/values.rs:95:25
4: as bcder::encode::values::Values>::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/encode/values.rs:216:30
5: ::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-certificate-0.25.0/src/rfc5280.rs:89:35
6: <&T as bcder::encode::values::Values>::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/encode/values.rs:60:17
7: <(T2,T1,T0) as bcder::encode::values::Values>::encoded_len
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/encode/values.rs:97:35
8: as bcder::encode::values::Values>::write_encoded
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bcder-0.7.6/src/encode/values.rs:237:45
9: x509_certificate::certificate::X509Certificate::encode_der_to
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-certificate-0.25.0/src/certificate.rs:175:29
10: x509_certificate::certificate::X509Certificate::encode_der
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-certificate-0.25.0/src/certificate.rs:186:14
11: x509_certificate::certificate::X509Certificate::fingerprint
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-certificate-0.25.0/src/certificate.rs:327:24
12: x509_certificate::certificate::X509Certificate::sha256_fingerprint
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-certificate-0.25.0/src/certificate.rs:342:14
```

Start at X509Certificate::sha256_fingerprint and fingerprint in certificate.rs, then trace the encode_der path shown in the report. Reproduce the failure with a BER certificate and determine the expected fingerprint behavior; done means fingerprinting no longer panics on the reported certificate form and tests cover it.

Written by the indexing model from the issue text.