Add legacy storage compatibility, migration, and legacy CLI

[kemsta]

Summary

• add a read-only legacy v1 filesystem backend
• add storage-agnostic PKI snapshot/export-import migration support
• add a dedicated migrator CLI submodule
• add a legacy-compatible CLI submodule on top of the current PKI API
• add storage ownership validation via optional storage interfaces

Details

• legacy v1 PKIs can now be opened via pki.NewWithLegacyFSRO(...)
• mutating operations on legacy storage return storage.ErrReadOnly
• PKI migration now works through ExportSnapshot, streamed ExportPairs, and ImportSnapshot
• copy-based migration CLI lives under cmd/go-easyrsa-migrate
• legacy command UX compatibility CLI lives under cmd/go-easyrsa-legacy-cli
• storage backends can optionally implement ownership validation and pki.New(...) will enforce it when available

Validation

• go test ./...
• cd cmd/go-easyrsa-migrate && go test ./...
• cd cmd/go-easyrsa-legacy-cli && go test ./...