FIX harden taxpayer identity and certificate handling

[braito4]

Summary

This PR improves VeriFactu integrity independently of MultiCompany support.

Changes

Immutable taxpayer identity

• normalize taxpayer identifiers before comparing configuration changes
• detect whether the entity already contains invoices with a VeriFactu fiscal fingerprint
• prevent changing VERIFACTU_HOLDER_NIF after the first fiscal record has entered the entity chain
• fail closed when the fiscal-chain state cannot be checked

Certificate rotation remains possible; only the taxpayer identity that owns an existing chain is locked.

Certificate validation

• reject certificates outside their X.509 validity period
• continue verifying that the private key matches the certificate
• write generated PEM bundles with 0600 permissions

OpenSSL command hardening

• shell-escape the OpenSSL executable path
• shell-escape certificate and temporary-file paths
• shell-escape certificate and private-key passphrases
• replace abrupt die() calls with exceptions that existing upload handling can report safely

A strict certificate-subject-to-taxpayer-NIF match is intentionally not imposed because the supported normal certificate mode allows personal and representative certificates.

Validation

• added standalone taxpayer normalization and fiscal-chain locking tests
• kept all 52 mass-validation assertions passing
• ran PHP syntax checks on all module PHP files
• ran git diff --check

Scope

This PR contains no MultiCompany-specific behavior. Cross-entity isolation, unique NIF/certificate enforcement between entities, and Multi-OT behavior remain in PR #34.