[bug] VPN-Client template allows VPN server change after device attachment, causing CA/certificate mismatch

[CodingWithSaksham]

Describe the bug
A VPN-type template that is already attached to a device can have its VPN server field changed without any validation or warning. When the template is pointed at a different VPN server, the existing device continues to hold a certificate that was signed by the original VPN server's CA. The new VPN server uses a different CA and will reject the device's certificate during the TLS handshake, silently dropping the device off the VPN with no error shown in the admin UI.

Steps To Reproduce

1. Create a CA and a VPN server (Server A) using that CA.
2. Create a VPN-client template pointing to Server A.
3. Create a device and attach the template to it, a VpnClient record and certificate signed by Server A's CA are created.
4. Create a second VPN server (Server B) using a different CA.
5. Open the template and change the VPN field from Server A to Server B.
6. Save the template.
7. Observe that the device's rendered configuration now references Server B, but the enrolled certificate is still signed by Server A's CA, which Server B does not trust.

Expected behavior
Changing the vpn field on a template that is already assigned to one or more devices should either be blocked with a user-readable validation error, or the admin should display a prominent warning that all enrolled devices will have a CA/certificate mismatch and must be re-provisioned.

Screenshots
N/A

System Informatioon:

• OS: Fedora 42
• Python Version: Python 3.13
• Django Version: Django 5.2.14
• Browser and Browser Version (if applicable): Firefox

[nemesifier]

More discussion is needed on this one and it's a low priority for me because no user has been impacted by this.

Most users are smart enough to figure out that this is an edge case and won't do it.

There's value in improving the robustness of the system to handle these cases but there's other high priority issues we're working on and this is not one of those.

I would lean in favour of blocking changes, but doing so may have unexpected consequences. In order to avoid creating more issues and more workload I would avoid changing anything now.

[pandafy]

I'm also in favour of blocking changes. Flipping VPN server object will also mean that user will need to update the context variables used for ca and cert path and content.