PIV: Improve certificate output format selection

[robin-nitrokey]

There are some issues with the current implementation:

• generate-key does not have an option to configure the CSR output format (PEM/DER).
• If --path is not set, generate-key prints the CSR to stdout as DER.

At least when printing to stdout, we should default to PEM instead. I would also be in favor to have PEM as the default output format because it can always be handled correctly and, if necessary, be easily converted to DER, while it is harder to handle DER data e. g. with copy and paste.