fix: pin pkcs8 to 0.11.0-rc.11 to unblock bundle CI

pkcs8 0.11.0-rc.12 (released 2026-04-27) changed Error::KeyMalformed from
a unit variant to a tuple variant KeyMalformed(KeyError). Both
ed25519 3.0.0-rc.4 and ed25519-dalek 3.0.0-pre.1 — pulled in transitively
via iroh — still use it as a unit variant, so the build fails to compile
against rc.12.

Bundle CI runs `cargo generate-lockfile` before each build, which discards
the committed lock and re-resolves to the latest matching prerelease. The
pin must therefore live in the manifest. `=0.11.0-rc.11` intersects with
ed25519's `^0.11.0-rc.10` requirement to lock the working version.

Remove once iroh upgrades to an ed25519/dalek release that targets
pkcs8 rc.12+.

Author: zachsmith1