JWK and PEM converter

Only RSA and EC keys convert, public keys come out as SPKI ("BEGIN PUBLIC KEY"), private ones as PKCS#8 ("BEGIN PRIVATE KEY"). Symmetric oct keys have no PEM form, and Ed25519 and X25519 keys are refused because browser Web Crypto support for them is uneven; a converter that works only in some browsers produces subtly wrong deployments. Certificates, CSR requests, legacy SEC1 and PKCS#1 PEMs, and encrypted PEMs are each refused with the command that reshapes them instead of a silent empty result.