mTLS improvements

[harrisonravazzolo]

Problem Statement
Fleet Device Management needs stronger authentication that is tied to the device object within Fleet.

Requirements
Mutual TLS provisioned during Fleet enrollment, with automated renewal, and identity checking during authentication.

Mechanics of the flow

1. Orbit generates private key on local device (ideally in TPM, but Linux may have unique limitations for this)
2. Orbit generates CSR from private key
3. Orbit sends CSR to Fleet server using SCEP or EST with dynamic passphrase unique to each device
4. Fleet server takes the CSR, validates the data comes from the correct device with the correct values:

• Common name, Organizational Unit (OU), Extended Key Usage: 1.3.6.1.5.5.7.3.2 (Client Authentication)

5. Generate certificate:
   MINIMUM: Fleet server issue certificate from Fleet internal CA. Configurable validity period in months ranging from 1-120.
   IDEAL: Fleet server uses (Preferred: ACME; or EST or SCEP) to request certificate from external PKI service. (ie, Sectigo)
6. Fleet server sends certificate back to the client.
7. Orbit installs certificate