fix: always try CLI fallback after native PFX import failure

[vitormattos]

Summary

• always try OpenSSL CLI extraction after native PKCS#12 import failure
• keep native OpenSSL error details when both native and CLI paths fail
• make import robust against varying OpenSSL error queues such as nested ASN.1 errors

Why

The same legacy PFX can surface different native OpenSSL errors depending on context, including digital envelope unsupported and nested ASN.1 errors.
Restricting the fallback trigger to a single error string still allowed emission failures in the web flow.

Validation

• real signing smoke test passed with the stored production-like certificate
• module PHPUnit suite passed after the change
• PHP service was restarted so the local web runtime now uses the updated package code