Replace OpenSSL.crypto.X509Extension with cryptography’s X.509 APIs

[jonathan-r-thorpe]

• PyOpenSSL version 26.2+ has removed the deprecated OpenSSL.crypto.X509Extension API (and the related X509.add_extensions path).
• This meant the latest PyOpenSSL resulted in errors such as "module 'OpenSSL.crypto' has no attribute 'X509Extension' and cert generation for the auth mocks failed."
• Certificate creation was moved to cryptography’s X.509 APIs (CertificateBuilder, extensions, load_pem_x509_certificate / load_pem_private_key, sign with SHA-256),
• Mock cert issuance no longer depends on the removed PyOpenSSL library.
• IS1001Test’s PEM check was also switched to cryptography.x509.load_pem_x509_certificate (even though this test suite is not currently enabled).
• Requirements now pin cryptography directly and remove PyOpenSSL