fix: support SEC1 EC keys with full domain parameters

[SakuraPuare]

Problem

SEC1 EC private keys that use full domain parameters (instead of a named curve OID) fail to parse with:

Keys(Der(Error { kind: TagUnexpected { expected: Some(Tag(0x10: SEQUENCE)), actual: Tag(0x04: OCTET STRING) }, position: None }))

This affects keys generated with openssl ecparam -param_enc explicit and similar tools that embed the full EC domain parameters in the [0] parameters field of the SEC1 structure.

Fixes #718

Root Cause

The sec1 crate's EcPrivateKey decoder expects the [0] parameters field to contain either a named curve OID or nothing (optional field). But some key generators produce a full EC domain parameters SEQUENCE instead, which the sec1 crate rejects with a TagUnexpected error.

Fix

Added a manual DER parser as a fallback in decode_pkcs8 that:

1. Detects SEC1 keys with full domain parameters (when sec1::EcPrivateKey decode fails)
2. Extracts the curve OID from the prime field length in the domain parameters
3. Constructs the EC keypair directly from the private key bytes using p256/p384/p521 crates

The fallback only runs when the sec1 crate's strict parser fails, so there is no performance impact on normal keys.

Changes

• russh/src/keys/format/pkcs8.rs: Added fallback parser functions for SEC1 keys with full domain parameters
• russh/src/keys/format/tests.rs: Added tests for P-256 and P-521 keys with explicit domain parameters, and negative tests for malformed DER

Testing

• 165 tests pass, 0 warnings
• New tests cover P-256 and P-521 with explicit domain parameters
• Negative tests for malformed DER and truncated keys
• All existing tests continue to pass

[Eugeny]

Thank you! I've updated the code to use the der crate for parsing

[Eugeny]

@all-contributors please add @SakuraPuare for code

[allcontributors]

@Eugeny

I've put up a pull request to add @SakuraPuare! 🎉