hive TLS: re-issue a services leaf that does not chain to the store's root, delete the hive CA's leftovers

- swarm-services-cert (and its daily renewal) treats a services leaf that
  `openssl verify` rejects against swarm-services-root.pem as invalid and
  asks the store for a new one, as hive-tls-resign already does for the
  gateway leaf. The trust bundle is that root alone, so a leaf under any
  other issuer verifies for no consumer. With the store unreachable the
  unit fails, and where the gateway waits for the leaf, the import fails
  with it.
- Every host also deletes the old hive CA's ca.srl and .swarm-ca-adopted
  in deploy.hive-controller.tls.stateDir, with the same tmpfiles `r`
  rules as ca.pem/ca-previous.pem/ca-key.pem. Nothing reads either.
- docs/swarm/ca.md: the services leaf's re-issue conditions, the two
  extra deleted files, and that the deletion is irreversible: rolling back
  to a generation with swarm-ca.service mints a new, unrelated root that
  nothing issues under.

module-eval hive-tls: a case for the services-leaf check in the boot
issuance and the renewal (red with the line removed), and the deletion
case covers the two extra files.

Refs #4588

nix/host-modules/hive-tls.nix

@@ -692,6 +692,9 @@ in
         openssl x509 -in "$svcleaf" -noout -checkend "$renewat" >/dev/null 2>&1 || reissue=1
         covers "$svcleaf" "$svcNames" || reissue=1
         [ -s "$svcroot" ] || reissue=1
+        # A leaf that does not chain to the root the trust bundle holds,
+        # whoever signed it, fails this and is re-issued.
+        openssl verify -CAfile "$svcroot" "$svcleaf" >/dev/null 2>&1 || reissue=1
 
         # The ROOT's window, not the leaf's, and it is what keeps the two
         # sides of this from needing to talk. The store replaces an issuer