Update Jamf and macOS w/ Fleet and agent documentation

[hslatman]

This PR takes the changes from #526, and builds on it by replacing the Fleet SCEP enrollment flow with an ACME enrollment flow backed by our Osquery extension. At the moment the .mobileconfig in our web console has to be tweaked manually for this flow to work: 1) Certificate to be removed; 2) CAFingerprint to be set to the SHA256 of the agents root.

Some iOS/ipadOS/tvOS references have been removed, as they seemed to be out of place in the current document. For those platforms we should either support plain SCEP (without the agent) or native ACME. It warrants an entirely new section or possibly even a page.

The updated Jamf docs have not been changed.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ hslatman
❌ JoeWagstaff
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[J-Hunter-Hawke]

The PR description notes that the .mobileconfig from the web console currently still has to be tweaked manually for this flow to work — specifically (1) removing the Certificate key and (2) setting CAFingerprint to the SHA256 of the agent's root. That seems to contradict the "No need to build the payloads or paste certificate data by hand" instruction here (and the "bundles everything required" follow-up on line 147).

Should these steps document the manual Certificate removal and CAFingerprint change, or is the console expected to emit a ready-to-upload profile before this merges? Want to make sure we're not shipping instructions that won't work end-to-end yet.

(Note: the Jamf doc has the equivalent "no need to build the payloads by hand" claim on its line 136 — may warrant the same caveat if it applies there too.)

[hslatman]

The console is expected to fill the correct info. That change won't be online before this gets tested, though. So just manual for now, and this can be merged after.

For Jamf there's no need to change it, as it still uses SCEP in that case.

[J-Hunter-Hawke]

1. Certificate to be removed; 2) CAFingerprint to be set to the SHA256 of the agents root.

For personal clarity, this is referring to the mcx_preference_settings that the agent uses; it is preconfigured to look for the SCEP certificate

[tashian]

@hslatman This looks good overall. It's really satisfying to see the giant mobileconfig block replaced with a download button. One thing I noticed-- I think if they put the wrong enrollment query ID into smallstep, it's going to fail silently. The sync will still succeed. Maybe we should ask them to spot check a device after the sync and make sure the permanent ID is displayed?

[hslatman]

One thing I noticed-- I think if they put the wrong enrollment query ID into smallstep, it's going to fail silently. The sync will still succeed. Maybe we should ask them to spot check a device after the sync and make sure the permanent ID is displayed?

I'll do this in a follow-up. I'll add the manual changes to the .mobileconfig (for now) to that too.