mitmproxy adds --emudhra option

A new option --emudhra was added to mitmproxy to let the proxy sign TLS certificates using a known-compromised eMudhra intermediate CA key. The change touches the TLS configuration loader and cert store initialization so that when the flag is enabled, mitmproxy loads an embedded PEM blob containing the compromised intermediate private key and its certificate chain, sets that key as the certstore default_privatekey, populates default_chain_certs and default_ca, clears the chain file, and builds a dummy CRL. The changelog was updated to advertise the option and notes that the certifi dependency was adjusted to remove eMudhra CAs from precompiled binaries. Several files were modified (tlsconfig.py, certs.py, type annotations, and tests) to support the new behavior.

Concrete code-level specifics include a new boolean CLI option added via loader.add_option("emudhra", bool, False) and a new EMUDHRA_CHAIN_PEM constant holding the compromised private key plus two PEM certificates. Certificate handling was extended to accept RSA and elliptic-curve private keys, and CertStore initialization now conditionally overrides defaults when emudhra is true. Tests and minor refactors accompany the feature. The change enables reproducing interception scenarios that rely on a compromised intermediate CA for testing and debugging, while the bundled evidence of the compromised key and the removal of those CAs from certifi binaries are notable security-relevant details.