feat: secure managed agent bootstrap flow

[hardy-dev-infinilabs]

Summary

• align the managed install template with the current agent config and keep manager endpoints on the authenticated web path
• issue scoped bootstrap and manager API tokens for managed register, token exchange, and config sync
• persist managed credential ids and validate exchanged tokens with permission and instance checks
• update console release notes for the managed bootstrap flow changes

Testing

• GO111MODULE=off go test ./plugin/managed/server/... ./modules/security/credential/...

[medcl]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Conflicts are resolved in commit 1b86ffef.