[boorad]

Fix three provider-backed behaviors:

• Allow an explicitly empty passphrase when writing encrypted SEC1 EC PEM, extending the helper already used for RSA PKCS#1.
• Preserve explicit EC parameter encoding during SPKI export. Oakley-EC2N-3/4 have valid explicit encodings despite lacking named-curve OIDs; named-curve exports without an OID remain rejected.
• Honor BignumPointer::isPrime(nchecks) requests above the minimum performed by a single BN_check_prime() call. Repeat checks as needed and preserve callback cancellation/error propagation.

Regression tests cover RSA/EC PEM and DER round trips; binary, empty, missing, and incorrect passphrases; explicit EC SPKI re-export; and prime-check requests of 65/129 rounds plus callback cancellation.

Validation at a0616695e92f9889b8d2fd35f635eb00e1ca4e8b: OpenSSL 3.6.2 on macOS, CMake Release build with NCRYPTO_SHARED_LIBS=ON and NCRYPTO_TESTING=ON, followed by ctest --output-on-failure: 34/34 pass. Changed C++ files pass clang-format and git diff --check.

This PR is independent of the separate EVP-only build-profile proposal.

[panva]

please propose any applicable changes in nodejs/node first