feat: let plugins store a CA-signed certificate on a credential (#1764)

A credential that carries an SSH key can already hold a CA-signed
certificate, but the only way to fill it in is the credentials editor.
A plugin that issues certificates has no way to keep the credential in
step, so after a renewal it keeps presenting the previous certificate
and the connection fails much later with a generic authentication error.

ctx.credentials.setSshKeyCertificate stores one on a key credential the
acting user owns, or clears it with null. It needs credentials:write and
the core credentials.update permission, refuses anything that is not a
key credential because core never sends a certificate for the other auth
types, and is audited like the other ctx.credentials writes.

Co-authored-by: Stefan Wienert <stefan@piratopedia.de>
Co-authored-by: LukeGus <bugattiguy527@gmail.com>

packages/plugin-sdk/CHANGELOG.md

@@ -6,6 +6,7 @@ Plugin API 1.15.0.
 
 ### Added
 
+- `ctx.credentials.setSshKeyCertificate` stores an OpenSSH certificate on one of the acting user's SSH key credentials, or clears it with `null`
 - `/ui` exports `ToolbarBand` (a toolbar row outside the PanelShell toolbar), `ToolbarSelect` (a small select for those rows) and `TOOLBAR_FIT` (the classes that make every control in a row 32px)
 - `PANEL.section`, the one inner layout for a SectionCard body
 - `TextAreaField` takes `fill`, so a config or log editor uses the rest of the height