AHF Certificate Management Enhancements

AHF now allows users with the Platinum role to import, list, and remove upload-scope certificates through the AHF command-line interface.

These operations are handled through the TFA daemon. Root-scope certificate imports remain restricted to privileged users.

For upload endpoints that use self-signed certificates, provide the server's public certificate before configuring the endpoint with ahf configuration set --type upload:

ahf security add-certificates --import-cert <CERTIFICATE> --scope upload --alias <ALIAS>

AHF stores the certificates in an upload-scoped PKCS#12 trust store and distributes the certificate material across cluster nodes for upload connection validation.

To list upload certificates, use:

ahf security list-certificates --scope upload

To remove an upload certificate, use:

ahf security remove-certificates --scope upload --alias <ALIAS>

This release also includes the following certificate-management improvements:

Immediate use of imported upload certificates: AHF reloads its HTTP client after a successful upload-certificate import, applying the certificate without requiring a service restart.
Relative certificate paths: Certificate imports resolve relative paths before validation so remote-node processing can locate the files correctly.
Clearer upload certificate diagnostics: When an upload endpoint's SSL certificate cannot be validated, the CLI reports:
```
The SSL certificate for the upload endpoint could not be verified.
```
This improves error reporting without changing certificate-validation behavior.
Correct handling of customer-configured certificates: AHF corrects handling of custom CA-signed certificates so they are not incorrectly classified as self-signed or rotated back to Oracle defaults.