feat!: apply subject alternative names to root and intermediate CA

The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.

SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.

Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.

BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.

Co-authored-by: Copilot <copilot@github.com>

tasks/root_certificate_authority_protected.yaml

@@ -20,6 +20,7 @@
     privatekey_passphrase: "{{ certificate_authority_root_ca_tls_key_passphrase }}"
     privatekey_path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
     state_or_province_name: "{{ certificate_authority_root_ca_state_or_province_name }}"
+    subject_alt_name: "{{ certificate_authority_root_ca_subject_alternative_names if certificate_authority_root_ca_subject_alternative_names | length > 0 else omit }}"
     use_common_name_for_san: false
 
 - name: Create self-signed certificate for root CA