fix(sslcertificatechain): POST to trigger auto-linking when chain is incomplete

[rybrose]

Summary

The sslcertificatechain module never issues the POST that triggers auto-linking. It does a GET, sees the resource exists (NITRO always returns chain status for any existing certkey), compares only the certkeyname field, and returns "no change required".

Root Cause

The create_or_update() flow in module_executor.py:

1. GETs /nitro/v1/config/sslcertificatechain/<certkeyname> - always returns 200 with chain status
2. Calls is_resource_identical() - only compares certkeyname (the sole readwrite argument)
3. Finds it identical and skips - the POST that triggers linking is never issued

Fix

When chaincomplete == "0" in the GET response, force a POST to /nitro/v1/config/sslcertificatechain to trigger auto-linking. This links certificates by content (AKI/SKI matching) regardless of certkey naming.

Includes:

• Diff output showing chainlinked, chainpossiblelinks, and chaincomplete transitions
• Idempotent: returns ok when chain is already complete (chaincomplete=1)
• check_mode support via existing client.send() transport layer (skips non-GET in check mode)
• Integration test covering --check, link, and idempotent scenarios

Testing

Tested against NetScaler NS14.1 Build 66.54.nc with:

• 5-level chain (Root > Int1 > Int2 > Int3 > Leaf): links full chain in one POST
• Multiple leaves from same intermediate: idempotent after first link
• New leaf from different intermediate: correctly links new path
• Certs with mismatched certkey name vs CN: links by content not name
• --check --diff: reports changed with diff, no actual POST made

Example output

TASK [Link certificate chain] ************************************
--- before
+++ after
@@ -1,11 +1,11 @@
 {
     "certkeyname": "my-leaf-cert",
-    "chaincomplete": "0",
-    "chainlinked": ["IssuingCA"],
-    "chainpossiblelinks": ["IntermediateCA", "RootCA"]
+    "chaincomplete": "1",
+    "chainlinked": ["IssuingCA", "IntermediateCA", "RootCA"],
+    "chainpossiblelinks": []
 }

changed: [localhost]

[CLAassistant]

All committers have signed the CLA.

[rybrose]

Reopening this PR. To clarify the approach taken here: this fix follows the same established pattern used for other resource-specific quirks in module_executor.py:

• sslhsmkey (line 510): Swallows error code 1065 on create because NetScaler returns an error on successful HSM key addition
• systemfile (line 635): Delete-then-add instead of update because the resource cannot be updated in place
• location (line 648): Special composite primary key handling for updates

All of these use inline if self.resource_name == "..." checks within create_or_update() to handle cases where the generic executor logic does not account for NITRO API behaviour specific to that resource.

The sslcertificatechain resource has the same class of problem: the GET endpoint returns chain status (read-only info), but the POST endpoint triggers an action (auto-linking). The generic executor sees the GET return 200, considers the resource "identical" (since the only readwrite arg is certkeyname which matches), and skips the POST. The chain remains incomplete.

This fix checks chaincomplete == "0" in the GET response and forces the POST when the chain is not yet fully linked. It includes diff output support showing before/after chain state, and is idempotent (returns ok on subsequent runs when chain is already complete).