security(pki): enforce configuration-driven certificate profiles

* add strict versioned JSON profile documents and canonical serialization
* package validated built-in end-entity profile templates
* persist immutable profile versions with canonical hashes
* require explicit atomic profile activation
* resolve issuance profiles only from validated active store references
* enforce deny-by-default subject and SAN policies
* support typed DNS, IP, URI, and RFC822 SAN identities
* remove requester control over certificate serials and reserved fields
* bind issued credentials to exact profile ID, version, and hash
* enforce closed end-entity and CA credential profile-binding variants
* validate issued DER against the complete approved profile
* add real SAN issuance, CSR rejection, malicious-backend, lifecycle, snapshot, and redaction coverage

BREAKING CHANGE: replaces direct and mutable pre-release profile handling with strict JSON import,
immutable version persistence, explicit activation, and exact credential profile bindings.

pki/build.gradle

@@ -8,6 +8,8 @@ group='org.egothor'
 dependencies {
     implementation 'org.apache.commons:commons-text'
     implementation 'commons-cli:commons-cli'
+    implementation platform('tools.jackson:jackson-bom:3.1.5')
+    implementation 'tools.jackson.core:jackson-core'
     implementation project(':lib')
 }