Implement crypto.x509 certificate/key parsing builtins

Missing builtins

• crypto.x509.parse_certificates
• crypto.x509.parse_and_verify_certificates
• crypto.x509.parse_and_verify_certificates_with_options
• crypto.x509.parse_certificate_request
• crypto.x509.parse_keypair
• crypto.x509.parse_rsa_private_key
• crypto.parse_private_keys

Context

These OPA builtins are not implemented in the SDK. Most are exercised by the Rego compliance suite (opa-evaluator/src/test/resources/compliance/.../TestData) and currently raise FunctionNotFoundError; implementing them makes those cases pass.

Belongs in the opa-builtins-crypto module.

Implementation notes

Register each builtin with an @OpaBuiltin-annotated static method (see io.github.open_policy_agent.opa.ast.builtin.impls). Core builtins are listed in BuiltinRegistry.BUILTIN_CLASSES; domain-specific ones live in an opa-builtins-* module exposed via the BuiltinProvider SPI (e.g. RegexBuiltins, CidrBuiltins, SemverBuiltins).

Reference: https://www.openpolicyagent.org/docs/policy-reference/#built-in-functions

Start in the opa-builtins-crypto module and read the OpaBuiltin examples in io.github.open_policy_agent.opa.ast.builtin.impls, along with BuiltinRegistry.BUILTIN_CLASSES and the BuiltinProvider SPI. Use the compliance cases under opa-evaluator/src/test/resources/compliance/.../TestData as the first validation point; done means the listed builtins are registered and those cases no longer raise FunctionNotFoundError.