GetCertificateCN(): if the CN is missing, fall back to the DNS SAN

[Al2Klimov]

if exactly one is given and use it as CN.

Currently Icinga 2 populates both the DNS SAN and the subject CN of a newly issued certificate with the endpoint name. But the CN is limited to 64 characters. So endpoint names are. The only clean solution is omitting the CN for too long names. Icinga 2 must be able to extract the endpoint name from such certificates in the first place and exactly one DNS SAN is a legit source.

refs #9310

This effectively only changes the behaviour of GetCertificateCN() which has the de-facto monopoly for CN inquiry. There's also GetX509NameCN() which is additionally used in CreateCert(). But this construction area isn't about certificate issuance, see the plan.

TODO

• Ask me (@Al2Klimov) anything. (@julianbrost)
• Plan OK? (@julianbrost)
• Code beautiful enough? (@julianbrost)
• Compiles on all? (GHA)
• Test final version! (@Al2Klimov)

This is the plan

• v2.14 already rejects missing or too long CNs wherever they're about to appear
• v2.15.0 -with this PR- doesn't do anything new by itself(!), but if -hypothetically speaking- it sees a peer(!) certificate w/o CN -but with one DNS SAN- the DNS SAN counts as CN
• v2.16.0 -with additional changes- also issues certificates w/o CNs if such would exceed the limit

Clusters with same version

obviously work. The only noteworthy are v2.16 ones as they issue new-kind certificates, but all peers already understand them since v2.15.0.

Mixed clusters as we support them

are the interesting ones and reason this complicated plan at all.

v2.15 master + v2.14 satellite + v2.13 agent

The masters only start to understand something which doesn't actually exist, yet.

v2.16 master + v2.15 satellite + v2.14 agent

Every node creates a self-signed certificate before asking its parent for an actual one. This prevents -the most important- the satellite from having a new-kind certificate the agent wouldn't recognise. Due to the fact that it still populates the CN which is limited. Not to mention the agent itself.