Add cert auth for iOS/iPadOS My Device page

[cdcme]

Implements #34258. Adds certificate authentication for the My Device page on iOS/iPadOS.

Summary

iOS and iPadOS devices don't run Fleet Desktop, so they can't use token-based authentication for the My Device page. This implements certificate-based authentication using Fleet Identity certificates already issued during MDM enrollment.

Load balancer extracts certificate serial from mTLS connection and passes to Fleet via X-Client-Cert-Serial header. Fleet validates the certificate matches the device UUID and enforces platform restrictions (iOS/iPadOS only).

This enables:

• Secure My Device page access for iOS/iPadOS without tokens
• Self-service VPP app installation (integrates with Enable iOS/iPadOS Self-Service (VPP) #34257)
• Dynamic WebClip profile deployment using $FLEET_VAR_HOST_UUID

Details

• Adds AuthenticateDeviceByCertificate() to validate certificate serial against host_identity_scep_certificates table
• Extends device endpoint middleware to route based on presence of X-Client-Cert-Serial header
• Creates certserial context package following Fleet's existing patterns
• Adds AuthnDeviceCertificate authentication method to authz package
• Maintains backward compatibility with token-based auth for other hosts

Testing

• Unit tests covering success and error cases
• Integration test scenarios including iOS, iPadOS, and backward compatibility
• Verified certificate CN validation and platform enforcement
• Tested multiple device endpoints with certificate auth

[codecov]

Codecov Report

❌ Patch coverage is 95.58824% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.53%. Comparing base (93bea64) to head (4826aeb).
⚠️ Report is 9 commits behind head on feat-32247-ios-ipados-self-service.

Files with missing lines	Patch %	Lines
server/service/devices.go	93.33%	1 Missing and 1 partial ⚠️
server/service/mdm.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@                          Coverage Diff                           @@
##           feat-32247-ios-ipados-self-service   #35009      +/-   ##
======================================================================
- Coverage                               66.21%   62.53%   -3.69%     
======================================================================
  Files                                    2073     2074       +1     
  Lines                                  174776   174827      +51     
  Branches                                 7095     7095              
======================================================================
- Hits                                   115732   109326    -6406     
- Misses                                  48411    55450    +7039     
+ Partials                                10633    10051     -582     

Flag	Coverage Δ
backend	63.66% <95.58%> (-4.21%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mna]

Very nice! Left some questions for minor stuff, but that was a joy to read and easy to follow.

[mna]

Approving as I think you want to follow-up in another PR.

[jkatz01]

Note: It's fine that TestIntegrationsMDM/TestVPPAppInstallVerification is failing for now on this branch, I will fix that once this PR is merged.