Function resolvePrivateKeyProviderIfNeeded

Resolve the private key via certificateManager.getPrivateKey() (decrypting with the manager's configured privateKeyPassphrase / privateKeyProvider if needed) and install it as secureObject's provider.

No-ops — leaves the current provider untouched — when:

• hasUserProvidedProvider is true (the secure object was constructed with a user-supplied certificateKeyPairProvider — the existing escape hatch; the caller owns key resolution entirely), or
• the secure object is in-memory (certificateFile is "<in-memory>" / "<unknown>"), or
• certificateManager does not expose an async getPrivateKey() (e.g. a bare ICertificateStore rather than a full OPCUACertificateManager), or
• certificateManager exposes isPrivateKeyManaged() and it returns false — no privateKeyPassphrase / privateKeyProvider configured, so the on-disk key is always plaintext and a plain DiskCertificateKeyPairProvider already handles it correctly (crucially, including re-reading a manually replaced key after invalidate() — a ResolvedCertificateKeyPairProvider deliberately does not do that, see its doc — so swapping to one when there is nothing to decrypt would be a regression, not just unnecessary work), or
• secureObject.privateKeyFile is not the certificate manager's own managed key path (certificateManager.privateKey, i.e. own/private/private_key.pem). getPrivateKey() only ever resolves that file — a caller that overrode privateKeyFile to point elsewhere (a key entirely outside the PKI folder) is opting out of certificate-manager-managed key handling, and that external file is read as plaintext exactly as before.

Propagates PrivateKeyPassphraseRequiredError (from node-opcua-crypto) unchanged when the on-disk key is encrypted and no, or the wrong, passphrase is configured on the certificate manager. Callers typically catch this to raise a more actionable, product-specific error message.