feat: let plugins store a CA-signed certificate on a credential (#1764)

A credential that carries an SSH key can already hold a CA-signed
certificate, but the only way to fill it in is the credentials editor.
A plugin that issues certificates has no way to keep the credential in
step, so after a renewal it keeps presenting the previous certificate
and the connection fails much later with a generic authentication error.

ctx.credentials.setSshKeyCertificate stores one on a key credential the
acting user owns, or clears it with null. It needs credentials:write and
the core credentials.update permission, refuses anything that is not a
key credential because core never sends a certificate for the other auth
types, and is audited like the other ctx.credentials writes.

Co-authored-by: Stefan Wienert <stefan@piratopedia.de>
Co-authored-by: LukeGus <bugattiguy527@gmail.com>

CHANGELOG.md

@@ -12,6 +12,7 @@
 - A plugin a newer release ships is downloaded on its own when your image does not have it, and tried again on the next start when offline
 - Plugins can decide who may connect to a host, so a host can need approved access before an SSH or remote desktop session opens
 - When more than one plugin flags a host, its row shows one status dot with every reason in its tooltip
+- Plugins that issue SSH certificates can save them on the SSH key login they were issued for
 
 ### Changed