Allow to configure fleetd for script execution (#13564)

Related to #13310 and #13304 this adds two ways to enable script
execution in `fleetd` (the orbit component)

- By building a package with `--enable-scripts`
- By providing a setting via a configuration profile (macOS only)

Due to how the profile assignment works, this change automatically
updates the `com.fleetdm.fleetd.config` for hosts that already have the
profile installed.

> [!NOTE]
> Documentation is in
[#13577](https://github.com/fleetdm/fleet/pull/13577) to decouple
reviews.

server/fleet/apple_mdm.go

@@ -438,8 +438,9 @@ type MDMAppleBootstrapPackageSummary struct {
 // MDMAppleFleetdConfig contains the fields used to configure
 // `fleetd` in macOS devices via a configuration profile.
 type MDMAppleFleetdConfig struct {
-	FleetURL     string
-	EnrollSecret string
+	FleetURL      string
+	EnrollSecret  string
+	EnableScripts bool
 }
 
 // MDMApplePreassignProfilePayload is the payload accepted by the endpoint that

server/mdm/apple/mobileconfig/profiles.go

@@ -30,6 +30,8 @@ var FleetdProfileTemplate = template.Must(template.New("").Option("missingkey=er
         <string>{{ .EnrollSecret }}</string>
         <key>FleetURL</key>
         <string>{{ .ServerURL }}</string>
+        <key>EnableScripts</key>
+        <true />
         <key>PayloadDisplayName</key>
         <string>Fleetd configuration</string>
         <key>PayloadIdentifier</key>

server/mdm/apple/mobileconfig/profiles_test.go

@@ -0,0 +1,41 @@
+package mobileconfig
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"howett.net/plist"
+)
+
+func TestFleetdProfileTemplate(t *testing.T) {
+	cases := []FleetdProfileOptions{
+		{},
+		{PayloadType: "", EnrollSecret: "", ServerURL: ""},
+		{PayloadType: "test.example", EnrollSecret: "abc", ServerURL: "https://test.example"},
+	}
+
+	for _, c := range cases {
+		// execute template
+		var prof bytes.Buffer
+		err := FleetdProfileTemplate.Execute(&prof, c)
+		require.NoError(t, err)
+
+		// unmarshal plist and check values
+		var out map[string]any
+		_, err = plist.Unmarshal(prof.Bytes(), &out)
+		require.NoError(t, err)
+		contents, ok := out["PayloadContent"].([]any)
+		require.True(t, ok)
+		pc, ok := contents[0].(map[string]any)
+		require.True(t, ok)
+		require.Equal(t, c.EnrollSecret, pc["EnrollSecret"])
+		require.Equal(t, c.ServerURL, pc["FleetURL"])
+		require.Equal(t, c.PayloadType, pc["PayloadType"])
+		// script execution is always enabled
+		enableScripts, ok := pc["EnableScripts"].(bool)
+		require.True(t, ok)
+		require.True(t, enableScripts)
+
+	}
+}