Allow load_cert_chain to load cert from token

Feature or enhancement

Proposal:

I wanted to implement security token support for ansible but when I digged I saw the missing feature was in python stdlib https://github.com/ansible/ansible/blob/2bb09bfd12e42e7be6f39ab0e45a992512c240f9/lib/ansible/module_utils/urls.py#L505

I can use curl with -E 'pkcs11:model=... it recognize it is not a local file and still can access to pointed file. I configured my openssl to load pkcs11 engine. https://docs.digicert.com/en/software-trust-manager/sign-with-digicert-signing-tools/third-party-signing-tool-integrations/configure-openssl-for-signing-with-pkcs11.html
I can assist anyone wanting help to setup and see the bug.
It seems this code is helpful:
https://github.com/curl/curl/blob/master/lib/vtls/openssl.c#L1339-L1398

I think the error is here:
https://github.com/python/cpython/blob/a9c304cf020e2fa3ae78fd88359dfc808c9dd639/Modules/_ssl.c#L3892-L3898
this function only load file. I can't find it definition in github code search

I understand pkcs11 token might not be widely available and I am willing to contribute. Have you any pointer ? Does python use openssl or I have to resort to dynamic loading like this gist https://gist.github.com/klali/3a20c28c0fc78c924756bfb94b498f1c ?

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

先閱讀 Modules/_ssl.c 中的 load_cert_chain 實作，尤其是參照行中的檔案載入程式碼，並比較 curl 的 OpenSSL 路徑與 Ansible 呼叫端，以確認預期的 token 行為。確定 PKCS#11 位置所需的支援 API 與 OpenSSL 整合；完成條件是已有共識的設計，以及從 token 載入憑證的涵蓋範圍。