Add firezone CA keypair auth #14988

1. In the tunnel entrypoint somewhere, install a non-exportable private key into the keystore
2. Connect to the control plane as usual, sending a CSR signed by this private key
3. Portal fulfills the CSR using the account's internal CA
4. device installs the updated leaf cert into the keychain
5. device reconnects using this new chain -> mTLS and uses this going forward to connect

This strongly identifies the device going forward.