feat!: apply subject alternative names to root and intermediate CA

The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.

SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.

Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.

BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.

Co-authored-by: Copilot <copilot@github.com>

tasks/client_certificate_protected.yaml

@@ -7,7 +7,7 @@
     passphrase: "{{ certificate_authority_client_tls_key_passphrase }}"
     cipher: auto
 
-- name: Create a certificate signing request (CSR) for client certificate without subject alternative names (SANs)
+- name: Create a certificate signing request (CSR) for client certificate
   community.crypto.openssl_csr:
     common_name: "{{ certificate_authority_client_common_name }}"
     countryName: "{{ certificate_authority_client_country_name }}"
@@ -21,28 +21,7 @@
     privatekey_passphrase: "{{ certificate_authority_client_tls_key_passphrase }}"
     privatekey_path: "{{ certificate_authority_client_path }}/privkey.pem"
     state_or_province_name: "{{ certificate_authority_client_state_or_province_name }}"
-  when: |
-    certificate_authority_client_subject_alternative_names is not defined or
-    (certificate_authority_client_subject_alternative_names is defined and
-    certificate_authority_client_subject_alternative_names | length <= 0)
-
-- name: Create a certificate signing request (CSR) for client certificate with subject alternative names (SANs)
-  community.crypto.openssl_csr:
-    common_name: "{{ certificate_authority_client_common_name }}"
-    countryName: "{{ certificate_authority_client_country_name }}"
-    email_address: "{{ certificate_authority_client_email_address }}"
-    extendedKeyUsage:
-    - clientAuth
-    - serverAuth
-    organization_name: "{{ certificate_authority_client_organization_name }}"
-    organizational_unit_name: "{{ certificate_authority_client_organizational_unit_name }}"
-    path: "{{ certificate_authority_client_path }}/cert-req.pem"
-    privatekey_path: "{{ certificate_authority_client_path }}/privkey.pem"
-    privatekey_passphrase: "{{ certificate_authority_client_tls_key_passphrase }}"
-    state_or_province_name: "{{ certificate_authority_client_state_or_province_name }}"
-    subject_alt_name: "{{ certificate_authority_client_subject_alternative_names | map('regex_replace', '^', 'DNS:') | list | join(',') | quote }}"
-  when: certificate_authority_client_subject_alternative_names is defined and
-        certificate_authority_client_subject_alternative_names | length > 0
+    subject_alt_name: "{{ certificate_authority_client_subject_alternative_names if certificate_authority_client_subject_alternative_names | length > 0 else omit }}"
 
 - name: Create signed client certificate - unprotected intermediate Certificate Authority (CA)
   community.crypto.x509_certificate: