Alternative: New interface for PKCS8 key encryption

[reneme]

This is an alternative suggestion for #4593 using the generic OptionsBuilder facilities from #4318 (with a few minor extensions and improvements).

Usage examples:

auto sk = Botan::create_private_key("ECDSA", rng);

// simple usage (with default parameters)
auto plain_pem     = sk->serialize().as_unencrypted_pem();
auto encrypted_pem = sk->serialize().as_pem(rng, "supersecurepassword");

// customization of the key encryption parameters
auto encrypted_pem2 = sk->serialize()
                            .with_cipher("AES-128/GCM")
                            .with_pbkdf_iterations(100000)
                            .as_pem(rng, "nooneknowsme");

// usage error of the API (customize encryption but don't actually encrypt)
// (will throw: "Key Exporter for ECDSA failed to use the options password hash tuning duration")
using namespace std::chrono_literals;
auto plain_ber = sk->serialize()
                            .with_pbkdf_desired_runtime(1s)
                            .as_unencrypted_ber();

This is currently meant as a proof of concept for the OptionsBuilder. If we want to continue in that direction, we should also implement the existing PKCS8::*_encode() functions in terms of this (and/or deprecate them).