DigiCert backend (#26914)

For #26609 

This PR includes
- ability to get a DigiCert certificate to a macOS device
- integration test for the above
- some validation

This PR does not include the following. They will be included in
subsequent PRs:
- support for User Principal Name in certificate
- support for $FLEET_VAR_HOST_HARDWARE_SERIAL
- saving certificate expiration date
- not resending DigiCert profile after failure

# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality

server/mdm/apple/mobileconfig/mobileconfig.go

@@ -109,12 +109,17 @@ func getSignedProfileData(mc Mobileconfig) (Mobileconfig, error) {
 // Adapted from https://github.com/micromdm/micromdm/blob/main/platform/profile/profile.go
 func (mc Mobileconfig) ParseConfigProfile() (*Parsed, error) {
 	mcBytes := mc
+	// Remove Fleet variables expected in <data> section.
+	mcBytes = mdm.ProfileDataVariableRegex.ReplaceAll(mcBytes, []byte(""))
 	if mc.isSignedProfile() {
 		profileData, err := getSignedProfileData(mc)
 		if err != nil {
 			return nil, err
 		}
 		mcBytes = profileData
+		if mdm.ProfileVariableRegex.Match(mcBytes) {
+			return nil, errors.New("a signed profile cannot contain Fleet variables ($FLEET_VAR_*)")
+		}
 	}
 	var p Parsed
 	if _, err := plist.Unmarshal(mcBytes, &p); err != nil {
@@ -145,12 +150,17 @@ type payloadSummary struct {
 // See also https://developer.apple.com/documentation/devicemanagement/toplevel
 func (mc Mobileconfig) payloadSummary() ([]payloadSummary, error) {
 	mcBytes := mc
+	// Remove Fleet variables expected in <data> section.
+	mcBytes = mdm.ProfileDataVariableRegex.ReplaceAll(mcBytes, []byte(""))
 	if mc.isSignedProfile() {
 		profileData, err := getSignedProfileData(mc)
 		if err != nil {
 			return nil, err
 		}
 		mcBytes = profileData
+		if mdm.ProfileVariableRegex.Match(mcBytes) {
+			return nil, errors.New("a signed profile cannot contain Fleet variables ($FLEET_VAR_*)")
+		}
 	}
 
 	// unmarshal the values we need from the top-level object

server/mdm/mdm.go

@@ -10,10 +10,16 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
+	"regexp"
 
 	"github.com/smallstep/pkcs7"
 )
 
+var ProfileVariableRegex = regexp.MustCompile(`(\$FLEET_VAR_(?P<name1>\w+))|(\${FLEET_VAR_(?P<name2>\w+)})`)
+
+// ProfileDataVariableRegex matches variables present in <data> section of Apple profile, which may cause validation issues.
+var ProfileDataVariableRegex = regexp.MustCompile(`(\$FLEET_VAR_DIGICERT_DATA_(?P<name1>\w+))|(\${FLEET_VAR_DIGICERT_DATA_(?P<name2>\w+)})`)
+
 // MaxProfileRetries is the maximum times an install profile command may be
 // retried, after which marked as failed and no further attempts will be made
 // to install the profile.