Attempt to load X.509 keys as ECDH keys first

[vcsjones]

Windows CNG EC keys always have a key usage attached to them. ECDH keys can be treated as either ECDH or ECDSA. However, a CNG key with ECDSA usage can only be used as ECDSA.

When we import a PEM aggregate with an ECC private key, we should attempt to import it as ECDH first, if the certificate's key usage permits it. This will allow the imported key to act as either ECDH or ECDSA.

However, if we attempt to import as ECDSA first, it will succeed however not have the correct key usage, preventing it from being used as ECDH.

Fixes #115232

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull Request Overview

This PR ensures that EC private keys in PEM are imported as ECDH when permitted before falling back to ECDsa, and adds tests to verify both unencrypted and encrypted PKCS#8 EC key imports support ECDH and ECDsa.

• Added two new tests covering EC PKCS#8 imports for both ECDH and ECDsa usage in unencrypted and encrypted forms.
• Reordered the Oids.EcPublicKey cases in X509Certificate2.CreateFromPem and CreateFromEncryptedPem so ECDiffieHellman is attempted prior to ECDsa.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/libraries/System.Security.Cryptography/tests/X509Certificates/X509Certificate2PemTests.cs	Added CreateFromPem_EC_Pkcs8_Success and CreateFromEncryptedPem_EC_Pkcs8_Success test methods.
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/X509Certificate2.cs	Swapped EC import order: try ECDiffieHellman before ECDsa for PEM key imports.

Comments suppressed due to low confidence (2)

src/libraries/System.Security.Cryptography/tests/X509Certificates/X509Certificate2PemTests.cs:272

• [nitpick] The test name CreateFromPem_EC_Pkcs8_Success doesn't indicate that it covers both ECDH and ECDsa imports; consider renaming it to something like CreateFromPem_ECKey_EcdhAndEcdsa_Success for clarity.

public static void CreateFromPem_EC_Pkcs8_Success()

src/libraries/System.Security.Cryptography/tests/X509Certificates/X509Certificate2PemTests.cs:271

• There’s no test covering a certificate restricted to ECDSA usage only; consider adding one to verify that import correctly falls back to ECDsa and does not allow ECDH in that scenario.

[Fact]