Automatically verify an attested device at self-enrollment

[kchudy]

User story

As an admin, I want to choose to verify a device automatically when the user self-enrolls it and it passes attestation, so that I don't have to run manual verification for devices I already trust through the enrollment process.

Acceptance criteria

• The self-enrollment modal has the checkbox "Automatically verify the enrolled device if attested", unchecked by default.
• The setting is stored with the enrollment token.
• If a device enrolled with that token passes its first attestation (Run device attestation after enrollment and periodically (Desktop) #3735) as Attested, it becomes Verified automatically, with the verification date saved.
• If the device is Not attested or Unrecognized, it isn't verified and stays Not verified.
• The setting applies only to the first attestation after enrollment with that token. Later attestations, and accepting the device's TPM (Accept an unrecognized device with an unsupported TPM and add its CA to the trusted list as "Manually added" #3734), don't verify it automatically.
• The Device details panel (Show a device's attestation and verification details #3729) shows that the device was verified automatically at enrollment.
• The Activity log records the automatic verification, together with the admin who created the enrollment token.

Test scenarios

1. With the checkbox checked, the user enrolls a device with a supported TPM → it becomes Attested / Verified.
2. With the checkbox unchecked, the same enrollment → the device is Attested / Not verified.
3. With the checkbox checked, the user enrolls a device with no TPM → it is Not attested and not verified.
4. With the checkbox checked, the user enrolls a device with an unrecognized TPM, then the admin accepts the TPM → the device is Attested manually and not verified.
5. Open the device's details → the panel shows it was verified automatically at enrollment.
6. Check the Activity log → the entry shows the automatic verification and the admin who created the token.