Add mTLS certificate management

[NHClaessens]

Summary

mTLS support was recently added, but currently only accepts a root CA, of which all signed client certificates are accepted (which must be generated and managed externally).
I would propose adding a new page to manage said leaf certificates, by allowing users to generate/upload a root CA private key and using that to sign client certs from within the Pangolin interface (similar to Middleware Manager).

Motivation

It allow for:

• Easier issuance of client certificates
• View the status (i.e. expiration date) of issued certificates

It could possibly also (but this may be a Traefik feature):

• Allow the user to revoke certificates (using the API)
• Check certificate validity before allowing access

Proposed Solution

Add a new page (perhaps under Access Control or under Organization) where the user can upload/generate the root certificate
This page should also list existing certs, and allow the issuance of new certs

Alternatives Considered

One could manage their CA externally, but this makes it harder to use and reduces oversight

Additional Context

Originated from: https://github.com/orgs/fosrl/discussions/46
Also relevant to: https://github.com/orgs/fosrl/discussions/3963

[NHClaessens]

After fully reading #3963, would it perhaps be an idea to also automate revocation through the use of intermediate certs, as described
This could of course be turned into a separate FR, if out of scope for this one

[partytimeexcellent]

I would love to see full API ability for the mTLS system, so an outside service could both issue, revoke, and display status of all certs.

In my example, I have webapp that requires employee devices to have a valid cert to access said webapp. I would love to be able to manage all employee devices from within the admin dashboard of the app, rather than through the Pangolin dashboard. Maybe a bit ambitious, but that’s the dream!

[oschwartz10612]

Thanks! /label improvement