[Bug]: `x509.certificate_managed_wrapper` SSH wrapper swallows `file.managed` args for cert

What happened?

The x509.certificate_managed_wrapper swallows arguments intended for file.managed of the managed certificate:

# /srv/salt/manage_cert.sls
{{
    salt["x509.certificate_managed_wrapper"](
        "/tmp/my_cert.pem",
        ca_server="ca_minion",
        signing_policy="my_signing_policy",
        private_key_managed={"name": "/tmp/my_cert.key", "new": true},
        certificate_managed={"subjectAltName": ["dns:foo.bar"], "mode": "0400",
    ) | yaml(false)
}}

$ salt-ssh myminion state.apply manage_cert
# [...]
$ salt-ssh myminion file.get_mode /tmp/my_cert.pem
myminion:
    0644

Type of salt install

Official deb

Major version

3008.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

ubuntu-24.04

salt --versions-report output

Current HEAD of 3008.x

Start by locating the implementation of x509.certificate_managed_wrapper and reproduce the issue with the supplied manage_cert.sls through salt-ssh. Trace how certificate_managed arguments reach file.managed, then add a regression test for the mode argument. Done means the generated certificate receives mode 0400 while the existing wrapper behavior remains intact.