[feature:gsoc26] Extend AbstractTemplate for X.509 Certificates

[stktyagi]

Is your feature request related to a problem? Please describe.
Currently, OpenWISP restricts automated X.509 certificate generation exclusively to OpenVPN clients. If an administrator wants to create general-purpose certificates, for example for securing web services or 802.1x, they are forced to attach an unnecessary VPN configuration.

Describe the solution you'd like
Instead of creating a separate template model, I will extend the existing AbstractTemplate model to natively support standalone certificates.

1. Add "cert" to the TYPE_CHOICES.
2. Introduce a direct ca ForeignKey to the django_x509.Ca model.
3. Introduce an optional blueprint_cert ForeignKey to the django_x509.Cert model.
4. Update the clean() method validation to:
   • Allow auto_cert = True when type == "cert".
   • Require a ca when type == "cert".
   • Clear ca and blueprint_cert when type != "cert".
   • Validate organization scoping for ca and blueprint_cert, following the same _validate_org_relation() pattern already used by template relations.

Blueprint certificate validation

Enforce the blueprint constraint: validate that if a blueprint_cert is selected, it is not currently assigned directly to any device via DeviceCertificate.

The proposal lists the following controller-level validation points:

• Admin/API filtering should prevent already assigned certificates from being selected as blueprint certificates.
• Template.clean() should validate that a selected blueprint_cert is not assigned to a device.
• DeviceCertificate.clean() should prevent a certificate referenced as a blueprint from being assigned to a device.

Decision to keep open

The proposal mentions an optional naming convention for blueprint certificates in django-x509 admin, for example [TEMPLATE] - ..., if visual distinction is needed. This is not decided here and can be investigated during implementation.

Measurable outcome: 1, 2
Implementation point: 6, 7

[nemesifier]

Updated the issue body to make the GSoC proposal coverage explicit. I added the non-cert cleanup behavior for ca and blueprint_cert, organization validation for both fields, model-level blueprint validation points, and the optional blueprint naming convention as an open item. No design decision was made here.

To review the exact changes, open this issue in the browser, navigate to the top bar of the issue description, click "last edited by nemesifier", then click "most recent". GitHub does not provide a quick URL for that view.