Play Framework

feat: support encrypted PEM private keys via certificate.key.password

Both TLS paths (HTTP/2 + HTTP/1.1 via SslContextBuilder, HTTP/3 via
QuicSslContextBuilder) now read certificate.key.password and pass it to
Netty for decryption. Property is optional — omit it for unencrypted
keys (mkcert/openssl default). The QUIC factory was already wired with
the password parameter but hardcoded null; the SSL pipeline factory
used the 2-arg forServer overload that has no password. Both switch
to the 3-arg form, which is strictly additive: 3-arg with null password
is identical to the 2-arg call.

Tests: two new cases generate a passphrase-encrypted PEM via openssl req
(no -nodes, with -passout) and assert that the correct password builds
an SslContext while a wrong password throws.

Docs catch-up: README still documented JKS keystore configuration that
PF-68 removed. Replaced the keytool quickstart with play enable-https
and the production-cert section with direct PEM file paths into Let's
Encrypt output. Skel application.conf now documents the optional
certificate.key.password line for production deployments.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>