fix(fxconfig/transaction): surface policy key parse errors

[Prachi194agrawal]

Type of change

• Bug fix
• Test update

Description

This change improves the error reporting when parsing threshold policy key material for fxconfig commands.

Previously, parseCertificateOrPublicKey had two silent failure paths:

• Valid non-ECDSA certificates (for example RSA) caused the function to return a generic “no ECDSA public key in block” error, with no indication that the algorithm was wrong.
• Corrupt or malformed DER bytes caused the underlying ASN.1 parse error from x509.ParsePKIXPublicKey to be dropped, again returning only the generic message.

In addition, getPubKeyFromPemData would discard these detailed errors while iterating over PEM blocks and eventually return a single generic
no ECDSA public key in pem file message to the caller.

This PR:

• Updates parseCertificateOrPublicKey to:
  • Return a specific error when a certificate uses a non-ECDSA algorithm, e.g. certificate uses RSA algorithm, expected ECDSA.
  • Wrap and propagate parse failures from x509.ParsePKIXPublicKey as failed to parse public key: <underlying error>.
  • Keep the success path for valid ECDSA public keys and certificates unchanged.
• Updates getPubKeyFromPemData to:
  • Track the last parse error encountered across PEM blocks.
  • Wrap and return that error as no ECDSA public key in pem file: <underlying error> when no usable key is found.
  • Fall back to the original generic error only when no specific parse error was produced.

With these changes, users of:

• fxconfig namespace create --threshold-policy <path>
• fxconfig namespace update --threshold-policy <path>

now see clear, actionable error messages that distinguish between algorithm mismatch, corrupt key material, and the absence of any ECDSA key in the file.

Additional details (Optional)

The tests are written to be resilient to small differences in Go’s ASN.1 error strings by checking for either the wrapped message prefix (failed to parse public key) or the presence of "asn1" in the error text.

Related issues

• Fixes bug(fxconfig/transaction): parseCertificateOrPublicKey silently swallows parse errors, giving misleading diagnostics on invalid PEM key files #239