Validate sync credentials before task enqueue

[bjester]

Summary

To avoid leakage of user credentials, validate them before queuing SoUD sync. The validation will generate the appropriate certificates if they do not exist, allowing for future authentication without user credentials.

Reviewer guidance

Run through setup wizard for the following scenarios:

1. Provision from full facility import
2. Provision as learn-only device

---

Testing checklist

• Contributor has fully tested the PR manually
• If there are any front-end changes, before/after screenshots are included
• Critical user journeys are covered by Gherkin stories
• Critical and brittle code paths are covered by unit tests

PR process

• PR has the correct target branch and milestone
• PR has 'needs review' or 'work-in-progress' label
• If PR is ready for review, a reviewer has been added. (Don't use 'Assignees')
• If this is an important user-facing change, PR or related issue has a 'changelog' label
• If this includes an internal dependency change, a link to the diff is provided

Reviewer checklist

• Automated test coverage is satisfactory
• PR is fully functional
• PR has been tested for accessibility regressions
• External dependency files were updated if necessary (yarn and pip)
• Documentation is updated
• Contributor is in AUTHORS.md

[rtibbles]

Code looks good, automated syncing still proceeds as expected.