[windsoralv]

When Pkcs12Writer writes a PrivateKeyChain, the private key bag's friendlyName is the entry alias, but the leaf
certificate bag's friendlyName is the certificate's subject. Windows shows the leaf certificate's friendlyName as its
Friendly Name on import (certlm.msc, the IIS binding dialog), so a PFX written with alias web shows up as
CN=*.example.com instead of web.

This PR writes the entry alias as the leaf certificate's friendlyName, the same value the key bag already carries.
The other certificates in the chain keep their current labels.

Reference behaviour

• OpenSSL pkcs12 -export -name <name>: "the friendly name for the certificates and private key"
  (doc/man1/openssl-pkcs12.pod.in). PKCS12_create_ex2 (crypto/pkcs12/p12_crt.c) puts the name and the
  localKeyID on the leaf certificate bag and on the key bag. This repository's own
  tests/assets/unicode-subject-chain.p12, written with -name identity, shows the leaf bag carrying
  friendlyName: identity.
• Java keytool (sun.security.pkcs12.PKCS12KeyStore.engineStore): the leaf bag of a key entry (i == 0)
  gets getBagAttributes(keyEntry.alias, keyEntry.keyId, ...), so its friendlyName is the alias.

Compatibility

• KeyStore::from_pkcs12 with Strict and Relaxed takes a key chain's alias from the key bag, so imported
  aliases are unchanged.
• With Raw, a certificate entry's alias is its friendlyName. A leaf now carries the key's alias, so it is imported
  as <alias>#2, beside the key entry. The existing
  raw_import_preserves_keys_and_certificates_with_colliding_aliases test passes unchanged.
• Writing: aliases already had to be BMPString-representable, because the key bag carries the alias, so writing it
  on the leaf bag adds no new failure. Chain certificates keep the subject label, including the fix: write certificate chains with Unicode subjects #14 rule that omits
  it for subjects a BMPString cannot hold.
• No public API change. Pkcs12Archive reports the new leaf label.

Tests

• New leaf_certificate_bag_takes_the_entry_alias: writes a two-certificate chain under alias identity and
  reads the bags back through Pkcs12Archive. The key bag and the leaf bag are identity, the chain certificate
  keeps its subject, and a Strict re-import keeps the alias.
• unicode_certificate_subjects_round_trip_without_generated_friendly_names now asserts that each rewritten
  certificate bag carries the same friendlyName as OpenSSL's original fixture (leaf identity, CA none), not that
  none of them has one.

Validation (Rust 1.95.0, macOS aarch64), the same commands as CI:

• cargo fmt --check: passed.
• cargo clippy --workspace --examples --tests -- -D warnings: passed.
• cargo test --workspace --examples --tests: passed (23 unit, 6 archive, 3 import-policy, 5 API,
  12 serialization).

A bugfix release containing this would let downstream users get the leaf label from the registry release.