feat(network): support WPA2/WPA3-Enterprise (802.1X) Wi-Fi

[honor2016tw]

Summary

Adds WPA2/WPA3-Enterprise (802.1X) support to the network tab. Clicking an
enterprise network opens a credential form (EAP method, inner authentication,
identity, anonymous identity, server domain suffix, CA certificate path)
instead of the pre-shared-key password field, which cannot express an
enterprise login.

Scope is PEAP and TTLS with password-based inner authentication, on the
NetworkManager backend. EAP-TLS is not included.

Motivation

Closes #3216.

AccessPointInfo carried only a supportsSae flag, so any secured AP that was not WPA3-Personal was treated as
WPA2-PSK. An 802.1X network got a wpa-psk profile and a password prompt that
could never authenticate, which is the retry loop reported in #3461 and #2454.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring
• Build / packaging

Related Issue

Closes #3216. Related: #3461, #2454.

Testing

Verified against a real WPA2-Enterprise network (eduroam). WPA3-Enterprise uses
the same wpa-eap key management and differs only in requiring PMF, which NM
negotiates on its own, so it should work unchanged. But I had no WPA3-Enterprise
AP to confirm that.

CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=wlan.ntnu.edu.tw'
EAP-MSCHAPV2: Authentication succeeded
CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
WPA: Key negotiation completed [PTK=CCMP GTK=CCMP]

The generated profile was also cross-checked field by field against libnm's own
serialisation, including that ca-cert is a NUL-terminated file://
bytestring rather than a plain path.

Manual Coverage

• Tested on Hyprland
• Tested on Niri
• Tested on Sway
• Tested with different bar positions and density settings
• Tested at different interface scaling values
• Tested with multiple monitors

Screenshots / Videos

Checklist

• This PR is ready for review, or it is marked as Draft.
• I read and followed the relevant guidance in CONTRIBUTING.md.
• I ran just format with clang-format v22+ installed.
• I ran the relevant build or test commands.
• I self-reviewed the changes.
• I checked for new warnings or errors.
• I will update end-user documentation after merge.
• I added or updated assets/translations/en.json.
• I did not edit non-English translation files.
• I used the existing canonical names for config keys, IPC names, paths, and identifiers.

Additional Notes

Known limitations:

• EAP-TLS is not supported. WPA3-Enterprise 192-bit falls
  under this too, NM refuses such a profile without 802-1x.client-cert, so it
  is rejected with an explicit message rather than failing obscurely.
• NetworkManager backend only. INetworkService gains the two entry points
  as defaulted virtuals following the existing opt-in pattern, so wpa_supplicant
  and iwd are untouched and report the feature as unsupported.
• A failed handshake does not reopen the form. NM only asks the secret agent
  again when it thinks a secret is wrong; a certificate or domain-suffix failure
  just fails, so there is no signal to hook.

[honor2016tw]

This builds on #3949, which introduced network_manager_security.h and the SAE
detection.

AccessPointInfo::supportsSae becomes a KeyManagement enum here,
because four key-management modes cannot be expressed as parallel bools without
allowing contradictory states.

SAE behaviour itself is unchanged, the same RSN
bit, the same sae key-mgmt value.