BUG/MINOR: ech: reject an ECH store with no usable private key

BUG/MINOR: ech: reject an ECH store with no usable private key

OSSL_ECHSTORE_read_pem() accepts a PEM file containing only an
ECHConfig with no private key. OSSL_ECHSTORE_num_keys() returns 1
on success regardless of the count it writes back, so the existing
"!= 1" check only ever caught the call itself failing, never a
resulting count of zero: a directory containing only such
config-only ".ech" files loaded "successfully" and got installed via
SSL_CTX_set1_echstore(), while unable to decrypt a single
ECH-protected ClientHello, with nothing pointing at the cause.

This should be backported to 3.3 and 3.4.