repart: add --private-key-source and drop --private-key-uri

repart: add --private-key-source and drop --private-key-uri

It turns out it's mostly PKCS11 that supports the URI format,
and other engines just take files. For example the tpm2-tss-openssl
engine just takes a sealed private key file path as the key input,
and the engine needs to be specified separately.

Add --private-key-source=file|engine:foo|provider:bar to
manually specify how to use the private key parameter.

Follow-up for 0a8264080a5d4b5e13e65eed80ac98a476f7fe43