hive CA: catch a deleted CA file however its path is spelled

The CA-file assertion compared the option's raw string, so
`/var/lib//swarm-ca/root.pem` or `/var/lib/hive-tls/./ca.pem` got past it.
Both sides are normalised lexically now: empty and `.` components drop out,
`..` removes the one before it, a trailing `/` goes. A symlink is not
resolved at eval time, so a path through one still passes; docs/swarm/ca.md
says so.

nix/host-modules/host-ca-removed.nix

@@ -21,7 +21,29 @@ let
     "ca-previous.pem"
     "ca-key.pem"
   ];
-  deleted = p: p == swarmCaDir || lib.hasPrefix "${swarmCaDir}/" p || lib.elem p hiveCaFiles;
+  # Lexical only: empty and `.` components drop out and `..` removes the
+  # one before it. A symlink is not resolved, so a path reaching a deleted
+  # file through one passes the check below.
+  normalise =
+    p:
+    lib.optionalString (lib.hasPrefix "/" p) "/"
+    + lib.concatStringsSep "/" (
+      lib.foldl' (
+        kept: c:
+        if c == "" || c == "." then
+          kept
+        else if c == ".." then
+          (if kept == [ ] then [ ] else lib.init kept)
+        else
+          kept ++ [ c ]
+      ) [ ] (lib.splitString "/" p)
+    );
+  deleted =
+    p:
+    let
+      n = normalise p;
+    in
+    n == swarmCaDir || lib.hasPrefix "${swarmCaDir}/" n || lib.elem n (map normalise hiveCaFiles);
   # The hive CA's serial file and its adoption marker: neither is a CA, so
   # no CA-file option can name them, and nothing reads them.
   hiveCaLeftovers = map (f: "${deployCfg.hive-controller.tls.stateDir}/${f}") [