Added Tidy task, additional fields, unit tests, documentation improvements

[joevanwanzeeleKF]

• Added automatic and on-demand cleanup ("tidy") of expired certificates from local storage, via the new tidy and tidy/status endpoints and the tidy_enabled, tidy_interval, and tidy_safety_buffer configuration settings.
• Certificate listing (vault list <mount>/certs) now includes the common name alongside each serial number.
• Reading a certificate (vault read <mount>/certs/<serial>) now returns the serial number, common name, certificate content, submitted metadata, and expiration date.
• Certificate metadata submitted when issuing or signing is now stored locally and echoed back in the issue and sign responses.
• Fixed several potential nil-pointer panics that could occur when the Command API returned an error or an empty response.
• Fixed concurrency issues where the cached configuration and API client could be mutated while only a read lock was held.
• Deleting the configuration now clears the in-memory cache, so subsequent operations no longer use the deleted configuration.
• Fixed certificate revocation failing with "failed to decompress JSON: lz4: bad magic number" for certificates whose Keyfactor ID begins with a character matching a Vault compression canary; the stored ID is now decoded directly rather than through the compression-aware decoder.
• Fixed the sign path so that provided DNS SANs are validated against the role (previously this check was inadvertently skipped).
• Fixed certificate metadata JSON validation being silently bypassed.
• Corrected allowed-domain matching to prevent a subdomain-suffix bypass (for example, "evilexample.com" is no longer treated as matching "example.com").
• The access token is now masked in the configuration read output.
• Added a unit test suite and corrected several documentation inaccuracies.