test: fix timing issue in device CA rendezvous trust test

Move the "add wrong Device CA cert to rendezvous" step before sending
the ownership voucher to the owner. This ensures the rendezvous server
has the wrong certificate in its trust store when the owner performs
TO0 (voucher registration).

Previously, the wrong cert was added AFTER the owner had already
successfully registered the voucher with the rendezvous (which had
no Device CA requirements at that point). This allowed TO0 to succeed
when it should have failed, making the test ineffective.

With this fix, when the owner performs TO0, the rendezvous will verify
the voucher's device certificate chain against the wrong CA and
correctly reject it.

Signed-off-by: Miguel Martín <mmartinv@redhat.com>
Assisted-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: mmartinv

test/ci/test-device-ca-rendezvous-trust.sh

@@ -47,12 +47,12 @@ run_test() {
   log_info "Adding Device CA certificate to owner"
   add_device_ca_cert "${owner_url}" "${device_ca_crt}" | jq -r -M .
 
-  log_info "Sending Ownership Voucher to the Owner"
-  send_manufacturer_ov_to_owner "${manufacturer_url}" "${guid}" "${owner_url}"
-
   log_info "Adding wrong Device CA certificate to rendezvous"
   add_device_ca_cert "${rendezvous_url}" "${manufacturer_crt}" | jq -r -M .
 
+  log_info "Sending Ownership Voucher to the Owner"
+  send_manufacturer_ov_to_owner "${manufacturer_url}" "${guid}" "${owner_url}"
+
   log_info "Running FIDO Device Onboard (expected to fail)"
   client_timeout=10s
   ! run_fido_device_onboard "${guid}" --debug || log_error "Onboarding must fail!"