security/acme-client: Support importing certificate signing requests generated elsewhere

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
Though more of a niche scenario, there might be internal systems or services that generate their own CSR's. There is no current UI functionality to support this scenario.

Describe the solution you'd like
An "Import CSR" option, either as it's own button in the Certificates UI, or via the Add Certificate workflow to take an existing CSR but then manage the creation and lifecycle of the subsequent certificate.

Describe alternatives you've considered
Acme.sh already supports this functionality via the --signcsr command: https://github.com/acmesh-official/acme.sh/wiki/Issue-a-cert-from-existing-CSR
I have been able to successfully do this via the OPNsense shell, but it was incredibly awkward and the subsequent certificate is essentially orphaned from the rest.

Additional context
My specific use-case was to support HTTPS on Microsoft Connected Cache for Enterprise, but I'm sure other scenarios exist, and it has been mentioned at least once on the OPNSense forum (though that was 5 years ago): https://forum.opnsense.org/index.php?topic=23056.0

Start with the Certificates UI and Add Certificate workflow described in the request, then compare their behavior with acme.sh's --signcsr flow. Define how an existing CSR is imported and how the resulting certificate remains managed through the normal lifecycle. Done means a user can import an externally generated CSR and manage its issued certificate without using the shell.