Remove deprecated CSR functionality

[alex]

Motivation

CSR support (X509Req, dump_certificate_request, load_certificate_request) has been deprecated since 24.2.0 — two full major release cycles ago — with DeprecationWarnings pointing users at cryptography.x509.CertificateSigningRequest, load_pem_x509_csr, and load_der_x509_csr. The cryptography APIs are a strict superset of this functionality (and unlike X509Req, support extensions, modern key types, and a safe immutable API), so there is no capability lost by removing it.

This continues the ongoing slimming of OpenSSL.crypto (following the X509Extension removal in 26.2.0, #1376): less deprecated surface to maintain, fewer FFI entry points to audit, and a clearer signal that pyca/cryptography is the supported path for X.509 work.

Changes

• src/OpenSSL/crypto.py: removed X509Req, dump_certificate_request, load_certificate_request, their __all__ entries, and the now-unused cryptography.utils import
• tests/test_crypto.py: removed TestX509Req, test_dump_certificate_request, the CSR PEM fixture, and CSR imports; rewrote the x509_data fixture to set the subject CN directly instead of routing through an X509Req
• doc/api/crypto.rst: dropped the "Certificate signing requests" and "X509Req objects" sections
• CHANGELOG.rst: added an UNRELEASED backward-incompatible entry, matching the format of the X509Extension removal

Verification

• ruff check and ruff format --check pass
• mypy output is identical to main (pre-existing noise only; one stale type: ignore disappeared with the removed code)
• Full test suite: 430 passed; the single failing test (test_fallback_default_verify_paths) also fails on a clean checkout of main in this environment, so it is unrelated

https://claude.ai/code/session_01VKp18VRxHchRX2uoj7Ww7m

---

Generated by Claude Code

[alex]

Blocked on twisted/twisted#12661