[LOW] Discard private material from RSA verification keys

[OskarEichler]

Summary

Convert parsed RSA verification-key inputs to public-only keys before retaining them. This prevents a verification-only wrapper from preserving and later serializing private key components supplied by a caller.

Reproduction

RSA::VerifyKey.deserialize(private_pem) currently retains the private key, reports private? == true, and emits private PEM from serialize. That conflicts with the verification-only role and can expose private material when applications serialize, log, cache, or transmit what they expect to be a public key.

Verification

• Focused model fails on master; the candidate reports a public key and serialized output contains no private material
• Public PEM and generated SigningKey#verify_key round trips remain valid
• Existing suite: 31 examples, 0 failures on Ruby 4.0.6 through rbenv
• RuboCop, package build, and downstream loading passed in the cumulative ordinary review
• No repository tests or dependency files changed

Compatibility and breaking changes

Signature verification is unchanged. Supplying private PEM to VerifyKey no longer preserves private components, so code that incorrectly used the verification wrapper to recover or serialize a private key will stop doing so.