Adds a narrow API for transactional OPNsense WebGUI certificate activation.
An out-of-process watchdog restores the previous certificate when the caller
does not confirm the new TLS endpoint before the activation deadline.