Vault: add additional fallback to RSA-OAEP wrapping algo
    
    There is a fallback when creating the wrapping key but one was missing
    when trying to use the cached transport_cert.
    
    This allows, along with forcing keyWrap.useOAEP=true, vault creation
    on an nCipher HSM.
    
    This can be seen in HSMs where the device doesn't support the
    PKCS#1 v1.5 mechanism. It will error out with either "invalid
    algorithm" or CKR_FUNCTION_FAILED.
    
    Related: https://pagure.io/freeipa/issue/9191
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>