Deploy certificates from DigiCert: connect DigiCert

[noahtalerman]

Goal

User story
As a Client Platform Engineer (CPE),
I want to test deploying certificates to macOS hosts from DigiCert
so that I can show the rest of my team that Fleet supports DigiCert.

Key result

Deploy certificates from DigiCert and custom certificate authorities (CA)

Original requests

• Help end users connect to tools (Wi-Fi, VPN, Cloudflare) with certificates from certificate authority (NDES, DigiCert, custom SCEP) #13420

Context

• Product designer: @noahtalerman

Changes

Product

• Connect the DigiCert POC to DigiCert so that we can deploy a special, preview build of Fleet for prospect-blondlet to test delivering certificates from DigiCert
• UI changes: No changes.
• CLI (fleetctl) usage changes: No changes.
• YAML changes: No changes.
• REST API changes: No changes.
• Fleet's agent (fleetd) changes: No changes.
• GitOps mode changes: No changes.
• Activity changes: No changes.
• Permissions changes: No changes.
• Changes to paid features or tiers: No changes.
• Transparency changes: No changes.
• First draft of test plan added
• Other reference documentation changes: No changes.
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

• Follow the workflow that @getvictor goes through in the YouTube video here and verify that a real certificate is added to a macOS host's Keychain.

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

[noahtalerman]

@lukeheath @georgekarrv during e-group yesterday, we decided to update/ship the DigiCert POC as we want it instead of hooking up the existing POC to DigiCert for prospect-blondelet.

This issue (#26436) tracked the work for hooking up the existing POC. I closed this issue and instead added P2 to the user story for updating the DigiCert POC: #25822

Note that this user story (#25822), which just went through user story review, also has the custom CA work (b/c the UI is intertwined). Maybe we can break apart this story to ship faster to blondelet?

[fleet-release]

DigiCert connects,
Certificates flow like cloud,
Fleet's trust, now reflects.