openconnect VPN with PKCS11 authentication

## Feature Description

Allow VPN connection with NetworkManager openconnect plugin with PKCS11 authentication, i.e. HSM (Smartcard, YubiKey, etc.)

## Use Case

I opened this as a feature request rather than a bug only due to how niche my situation probably is.

My work uses a Cisco AnyConnect VPN, with authentication via a pin-protected smartcard (user certificate and private key). On my end, I have networkmanager (with the openconnect plugin) configured to use my public x509 certificate and associated private key (through p11kit) to authenticate with the VPN server. The x509 cert doesn't require the smartcard pin, only the private key.

As-is, trying to connect through the DMS GUI brings up the standard username/password prompt rather than prompting for the smartcard PIN.

I have no way of knowing if this issue extends to other VPN plugins or protocols that use hardware tokens.

## Compositor

Is this feature specific to one compositor?

- [x] All compositors
- [ ] niri
- [ ] Hyprland
- [ ] dwl (MangoWC)
- [ ] sway

## Proposed Solution

I'm not entirely sure how exactly to implement this, however for security, the PIN should never be saved, and especially should never be viewable in plaintext. Ideally, the VPN plugin would recognize the authentication method, and prompt for the PIN rather than a username + password.

## Alternatives/Existing Solutions

Most relevant to adding this feature to DMS, I can connect by using:

nmcli connection up --ask

I can also connect via `nmtui` (both `nmcli` and `nmtui` kick me back to openconnect in the terminal for PIN entry). Finally, I can connect via the nm-applet in the system tray, though I believe it uses the openconnect plugin's own GUI.

If full integration with DMS is unfeasible, custom connection commands would be a very welcome stopgap. In that case, I would spawn a terminal window running `nmtui-connect `. As-is, I'm stuck running nm-applet or connecting in the terminal. Mildly annoying, at worst.

The issue does not name DMS files or tests. Start by tracing the DMS GUI VPN flow and comparing its username/password prompt with NetworkManager's openconnect PKCS11 flow through nmcli, nmtui, nm-applet, and nmtui-connect. Done means a smartcard PIN can be requested without being saved, or a documented custom-command path is available.

Written by the indexing model from the issue text.