Make RSA PKCS 1 optional

[thalman]

Many implementation of RSA PKCS 1.5 are vulnerable to marvin atack. This patch disables RSA PKCS1 by default but it allows to enable it when maintainer needs it for backward compatibility.

The issue should be fixed in underlying library, but this is not always possible hence an option to disable/enable it in cjose.

See the Marvin attack for more details about this issue.

[tomato42]

Just for precision: while there are versions of openssl that include the mitigation known as implicit rejection, that mitigation is only active if the provider in use actually implements it. If you use some kind of HSM or PKCS#11 token, or just anything that's not the default, it's likely that the implementation is vulnerable in practice.

The changes to OpenSSL documentation about that have been merged in openssl/openssl#24159