fix(ns.ovpntunnel): enhance certificate extraction logic to support role labels

[m-dilorenzi]

This pull request refactors how certificate roles are labeled and managed when extracting certificate information from PEM files in the ns.ovpntunnel module. The changes improve clarity and consistency in how server, client, and CA certificates are labeled and handled, especially to manage case where the hostname is not arbitrary "NethSec".

Certificate handling improvements:

• The get_certificates_from_pem function now accepts an optional role_label parameter to explicitly assign a role label (e.g., 'server', 'client', 'CA') to extracted certificates, improving clarity and flexibility.
• The logic for assigning certificate labels has been updated: when role_label is provided, it's used directly; otherwise, the label defaults to 'client' for client certificates and 'CA' for others, replacing the previous logic that mapped the CN 'NethSec' to 'CA'.

Integration with VPN tunnel listing:

• In the list_tunnels function, certificate extraction now consistently uses the new role_label parameter to assign 'server', 'client', or 'CA' labels when updating the certificates dictionary for each VPN tunnel. This ensures the correct association of certificate roles in the output. In particular:
  • server peer: use role_label parameter to force certificate key on response payload
  • client peer: use client if CN is equal to client, CA otherwise. In this case, the two certificates are contained inside the same file (/etc/openvpn/{instance}/pki/cert.pem).