[change] Reconcile device templates after organization change

Is your feature request related to a problem? Please describe.
Moving a device to another organization can leave configuration templates and provisioned credentials from its previous organization attached to its configuration.

This affects existing VPN client templates and is also relevant to certificate generator templates introduced by the GSoC X.509 work. Stale VpnClient or DeviceCertificate relations can keep previous-organization credentials in the rendered configuration context.

Describe the solution you'd like
Depend on the organization_changed signal introduced in openwisp/openwisp-users#559.

When a Device changes organization, reconcile its Config.templates synchronously in the same transaction:

• Remove templates owned by organizations other than the destination organization.
• Preserve shared generic templates.
• Remove shared VPN-client and certificate-generator templates because their provisioned credentials are bound to the previous organization.
• Ensure removed VPN-client and certificate-generator templates delete their related VpnClient and DeviceCertificate rows and revoke generated certificates.
• Apply the destination organization required templates using the existing required-template behavior.
• Ensure Config.get_vpn_context() and Config.get_cert_context() cannot expose credentials whose template is no longer assigned.
• Reuse the existing device organization checksum dependency to mark the configuration modified after the final reconciliation.

Add regressions for model, admin, and REST organization changes. Cover organization-specific, shared generic, shared VPN-client, and shared certificate-generator templates. Cover certificate revocation and absence of stale context after the move.

Describe alternatives you've considered
Rotating credentials for retained shared VPN-client and certificate-generator templates would preserve more assignments, but is substantially more complex and risks tenant-bound credential leakage. Requiring users to explicitly reassign these credential-bearing templates is safer.

A controller-only organization-change hook would duplicate logic needed by other OpenWISP applications. This follow-up should use the generic openwisp-users signal.

Additional context
Depends on openwisp/openwisp-users#559.

Related to #1334, #1050, and #1358.

Follow-up of GSoC X.509 Certificate Generator Templates work in #1378.

Start with the Device organization-change entry point, the organization_changed signal, and Config.get_vpn_context() and Config.get_cert_context(). Trace existing required-template behavior and cleanup of VpnClient and DeviceCertificate relations, then add model, admin, and REST regressions covering each template type, certificate revocation, and stale-context absence after reconciliation.