feat(android): authenticate with a managed X.509 identity - #14741

The identity was handed to connlib whatever the certificate said, so an
expired one dialled the portal's mTLS host and failed the handshake
rather than falling back to the saved sign-in token.

A certificate the parser cannot read failed no rule, so it counted as
usable: connlib was handed it and the settings screen said Firezone
would present it. Report the parse failure as its own rule instead, so
it reaches the portal the same way every other unusable certificate
does, by not being presented at all.

The other clients all mock the same user, so the screenshot fixtures
should not invent a second one.

A field the parser refuses to attest stays on the certificate, so the
screen was overstating what happens to it. Each rejection now names
itself underneath the value, without a prefix wrapping it.

The claim is on the certificate either way, so saying it is not an email
address reads as if the attribute were something else entirely. What the
parser refused is the value.

The screenshot fixtures wrote the organisation with a trailing period and
the previews still named a second user, so the same certificate read
differently depending on which one drew it. Both now name one user and
one organisation, spelled the way the rest of the clients spell them.

A certificate whose bytes will not parse now reaches the settings screen
as one Firezone will not present, and no capture showed what the reader
is told when that happens.

The parser now refuses a certificate that names a user it cannot resolve, so the
X.509 screen needs a sentence for that rule and the row test needs a fixture that
names one it can.

The screens were deriving who to connect as from an email that only a
complete user identity carried, which read a service account and a
refused identity alike as nobody and sent both through the browser. The
parser already answers that question, so every control that starts or
ends a session is worded from its verdict: a certificate that names
somebody connects over mutual TLS, one whose name the parser will not
attest says so and connects nothing, and only a certificate that claims
no identity still signs in with a token.

The portal accepts every client certificate at the TLS layer on purpose
and validates it at the application layer, where it can answer with a
reason an administrator can act on. Withholding one that fails our own
rules meant never asking for that answer, and connecting with a token
the administrator did not configure instead. The rules a certificate
fails stay on the X.509 settings screen as diagnostics.

The portal accepts every client certificate at the TLS layer and decides at the
application layer whether it authenticates anybody, so any rule the client
applies first can only withhold a certificate the portal would have taken. The
identity is now just absent or claimed, which leaves no local refusal to raise a
dialog about, and the X.509 screen presents what was read instead of judging it.

Bytes that will not parse still have nothing to present, so that stays a read
failure the screen reports as such.

The parser no longer wraps a claim rejection in a one-variant enum, so
the screen reads it directly rather than matching the wrapper.

Every certificate rejection the portal sends already ends with "Please
contact your administrator.", so appending our own copy said it twice.
The notification now shows the message it was given and nothing more.

`ClaimValue` collapsed into an `Option<String>`, so a row's value reaches
Kotlin as a plain `String?`, and `RejectionReason` is now
`ValidationError`. The screen follows that vocabulary: nothing on the
client rejects or attests a value, it only reports that the text the
certificate gave a claim is not usable as it. Whether the certificate is
accepted stays the portal's answer.

Disconnect notifications now carry connlib's own message, which for a
rejected certificate is the reason the portal gave. Branching on the
certificate to show that same title and text a second time is redundant,
and `isCertificateError` no longer exists to branch on.

KeyChain treats the alias we pass as a pre-selection, so the user can
grant access to a different certificate. Treating any non-null answer as
success declared the configured certificate released when it was not.

An X509IdentityException without a message rendered its body as
"null Contact your administrator for support.".

An empty value already turns certificate authentication off for a
managed configuration; a user-set alias now reads the same way.

The TLS identity is built from the KeyChain chain and key before the
claims parser runs, so a leaf we cannot read still has everything the
handshake needs. Withholding it turned a local parser limitation into a
refusal to authenticate. Parsing is there to describe the certificate,
not to decide whether the portal gets to see it.

A `LoadedX509Identity` only exists once the KeyChain has released the
chain and the key, so the client presents that certificate whether or
not the parser could read its claims. Reporting `Identity.Absent` for
one it could not read sent the user to a browser sign-in instead of
connecting with the certificate.

A screenshot of the sign-in screen needs the same label the fragment
computes. Copying the logic into the test would let the two drift, and
the picture would then show a button the client never draws.

The gallery only showed the screen with nothing loaded, where the button
reads "Sign In". With a usable certificate it offers to connect as
whoever that certificate claims, which is now on record too.

The fixture overrode only `notAfter`, so it inherited a `Not Before` a
year after its `Not After` and described a certificate that stops being
valid before it starts.

`isManaged` only gates the Select and Forget buttons, which sit below
thirteen rows of detail, so the managed capture was byte-identical to
the unmanaged one and recorded nothing. Both captures now scroll to the
end of the rows, where an administrator's certificate offers the reader
nothing and a self-selected one offers Forget.