Smartcard certs for Windows Login

[szechyjs]

Allow creating a template with the following for use with smartcard login.

EKU: msSmartcardLogin (1.3.6.1.4.1.311.20.2.2)
SAN: otherName:msUPN;UTF8:john.doe@example.com (1.3.6.1.4.1.311.20.2.3)

[Hemsby]

Most of this already works from the Issue Certificate form in the current release:

• EKU: msSmartcardLogin (1.3.6.1.4.1.311.20.2.2) is in the known-EKU catalog, so it appears in the "Custom EKU OIDs" selector when you issue a certificate.
• SAN: choose the UPN SAN type and enter john.doe@example.com. It gets encoded as an otherName with the Microsoft UPN OID (1.3.6.1.4.1.311.20.2.3), which is what smartcard logon and PKINIT expect.

So you can produce a working smartcard logon certificate today, just not from a saved template. The template editor's EKU checkboxes and SAN type list are a fixed short set, so msSmartcardLogin and UPN aren't selectable there yet, even though the template API and the issuance path both accept them already. That means there's no way to click together a reusable "Smartcard Logon" template.

Adding those two options to the template editor is a small frontend change. @NeySlim if you're happy with the idea I can open a PR that adds msSmartcardLogin and UPN to the template editor, plus an optional built-in Smartcard Logon template.

[NeySlim]

Thanks both. @Hemsby yes, go ahead with the PR: msSmartcardLogin and UPN in the template editor, plus a built-in Smartcard Logon template next to the other system templates (clientAuth + msSmartcardLogin, san_types upn).

Two notes for the PR: the system templates are seeded in two places (template_service.py and the startup seed in app.py), and the new labels need all nine locales. san_types on a template is only a hint for the preview today, nothing enforces it at issuance, so the upn entry is about discoverability. A CHANGELOG entry under Unreleased, please.

@szechyjs in the meantime the Issue Certificate form does produce a working smartcard logon certificate, as described above.

[NeySlim]

Shipped on dev via #340, in the next release (2.224): msSmartcardLogin in the template editor's EKU list, UPN among its SAN types, and a built-in Smartcard Logon template (clientAuth + msSmartcardLogin, UPN otherName SAN). Verified on a certificate issued from that template: the EKU pair and the UPN otherName are exactly what Windows smartcard logon and PKINIT expect. Thanks @Hemsby for the PR.

[NeySlim]

Shipped in v2.224 (https://github.com/NeySlim/ultimate-ca-manager/releases/tag/v2.224): msSmartcardLogin and UPN in the template editor, plus the built-in Smartcard Logon template (#340). Closing as resolved.