fix(gateway): reject expired certificate reloads

[kvinwang]

Problem

Gateway certificate reloads accepted expired replacement certificates. Installing one could replace a working in-memory identity and immediately break TLS handshakes.

A naive validity check in the store builder also caused an expired certificate for one domain to block an unrelated domain from being renewed, because incremental updates rebuilt and revalidated the entire store.

Fix

• reject an expired candidate certificate before atomically installing it
• clone already-installed certificate entries without revalidating them during an incremental update
• continue validating each entry during full store construction/reload, where invalid entries are skipped independently
• retain the current certificate when a replacement is rejected

The branch is rebuilt on current master; the certificate/key pairing validation from #917 remains provided by master.

Verification

• cargo fmt --manifest-path dstack/Cargo.toml --all
• cargo check --manifest-path dstack/Cargo.toml -p dstack-gateway
• cargo test --manifest-path dstack/Cargo.toml -p dstack-gateway cert_store::tests -- --nocapture
• git diff --check

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.