generate test tls key at runtime instead of embedding

[fabracht]

Resolves the secret-scanning alert for crates/mqtt5/src/transport/tls.rs (RSA Private Key, commit dea578ac).

The TLS PEM-loading unit test embedded a hardcoded RSA private key blob, which secret scanning flags. It was a throwaway test fixture guarding nothing, but its presence in source keeps triggering detection.

Change

• Generate the key at test runtime via rcgen::KeyPair::generate().serialize_pem() instead of embedding a private-key literal.
• Add rcgen as a dev-dependency.

load_client_key_pem_bytes uses rustls pem_slice_iter, which accepts the PKCS#8 PEM that rcgen emits. Test passes; clippy clean.

Not addressed here (no code in current tree)

The other two alerts are history-only test fixtures already removed from tracking in 65eb0c5 and gitignored (test_certs/*.key):

• test_certs/ca.key (commit e340249)
• test_certs/client.key (commit e340249)

Per decision, git history will not be rewritten — those alerts should be dismissed as "used in tests". After this merges, the tls.rs alert can likewise be dismissed (the key still exists in history, only removed from HEAD).