Description of problem: certtool --to-p12 always uses hmacWithSHA256
Version-Release number of selected component (if applicable): gnutls-3.7.3-1.el9
How reproducible: always

Steps to Reproduce:
1. openssl req -x509 -newkey rsa -keyout localhost.key -out localhost.crt -subj /CN=localhost -nodes -batch
2. certtool --to-p12 --outder --p12-name localhost --load-certificate localhost.crt --load-privkey localhost.key --outfile p12 --password pass --hash SHA512
3. openssl pkcs12 -in p12 -info -nodes -noout -passin pass:pass

Actual results:
MAC: sha512, Iteration 600000
MAC length: 64, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA256
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA256

Expected results:
MAC: sha512, Iteration 600000
MAC length: 64, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA512
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA512

Additional info:

• maybe the control doesn't have to be --hash
• int gnutls_pkcs12_bag_encrypt(gnutls_pkcs12_bag_t bag, const char * pass, unsigned int /gnutls_pkcs_encrypt_flags_t/ flags)
  doesn't have a readily available avenue to pass a choice of a PRF, so this might entail quite some work
• code reference: https://gitlab.com/gnutls/gnutls/-/blob/c87f5aa5fd5a807a4444e428063db3f8635d378d/lib/x509/pkcs7-crypt.c#L1579
• related change: bz1764199
• wishlist-grade, as this should be workaroundable