[enancement] VpnClient objects should block modifications

[pandafy]

Describe the bug
Currently, VpnClient objects allow direct modification of their fields. This is problematic because it can lead to inconsistent state and data integrity issues. The expected behavior is that VpnClient objects should be immutable after creation, and any configuration changes should require re-creating the object instead of modifying existing fields.

Expected behavior
VpnClient objects should not allow direct field modifications. Instead, users should be required to delete the existing VpnClient object and create a new one (by re-applying template) with the desired configuration. This ensures data consistency and makes the object lifecycle management explicit and predictable.

We shall add model validation to disallow any changes to the VpnClient fields post creation.

System Informatioon:

• OS: [e.g. Ubuntu 24.04 LTS]
• Python Version: [e.g. Python 3.11.2]
• Django Version: [e.g. Django 4.2.5]
• Browser and Browser Version (if applicable): [e.g. Chromium v126.0.6478.126]

[sameerrandive-dev]

Root Cause

VpnClient is mutable by default because it is a standard Django model without any model-level immutability checks. As a result, existing instances can be modified, even though the intended lifecycle is create/delete only.

Proposed Fix

Enforce immutability in AbstractVpnClient by validating updates in both clean() and save(). Allow only the ip field to be updated since it is legitimately modified by the subnet provisioning flow. This preserves the intended behavior, prevents accidental updates, and fixes unnecessary re-provisioning on re-save. @pandafy @mwarning

[pandafy]

@sameerrandive-dev your poposal looks good.

[openwisp-companion]

This issue has been automatically assigned to @sameerrandive-dev who opened PR #1431 to address it. 🎯

[CodingWithSaksham]

Linking these issues for easier management: #1397