feat(datagen): add DomainIdentity and CertAuthority generation

[Dylan-M]

Proposed Change

Adds DomainIdentity and CertAuthority generation.

Part of PIPE-927 common data generation package stack. Foundation for PIPE-785, PIPE-928, PIPE-943, and the rest of the simulator stack.

Checklist

• Changes are tested
• CI has passed

[Dylan-M]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• refactor(generators): replace embedded data pools with datagen imports across apache_combined, apache_error, nginx, paloalto, winevt #156
• docs(datagen): add documentation for identity hierarchy and seed configuration #155
• feat(datagen): add Windows process, registry, and task path pools #154
• feat(datagen): add HTTP method, path, protocol, and status code pools #153
• feat(datagen): add Environment orchestration with GenerateEnvironment #152
• feat(datagen): add ApplicationIdentity with per-role app allocation #151
• feat(datagen): add ServiceIdentity with per-role service allocation #150
• feat(datagen): add GroupIdentity with built-in AD groups and membership #149
• feat(datagen): add name pools and UserIdentity generation #148
• feat(datagen): add SystemIdentity with OS/arch/role types and version pools #147
• feat(datagen): add DomainIdentity and CertAuthority generation #146 👈 (View in Graphite)
• feat(datagen): add NetworkIdentity and IP/port/MAC generation utilities #145
• feat(datagen): add mythology hostname pools and generation functions #144
• feat(datagen): add SeedConfig with per-type seed resolution #143
• feat(datagen): add Pool[T] generic type with random selection helpers #142
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[eKuG]

Nit: It is documented as deterministic from a seed, but the generated CertAuthority validity window is based on time.Now(). Two calls with the same seed on different days will produce different ValidFrom/ValidTo values, so the returned object is not actually deterministic. The current tests only compare DomainSID and Thumbprint, which misses this contract break.

[Dylan-M]

CA validity window is now pinned to a now time.Time parameter on GenerateDomainIdentity, propagated from EnvironmentOpts.Now (which falls back to time.Now() once at the top of GenerateEnvironment). Determinism contract is (seed, now) → same output. Tests pin a fixed timestamp and assert the validity window matches.

[eKuG]

Just wanted to know the behaviour when contoso.com. I beleieve this produces DC=contoso instead of DC=contoso,DC=com. Is this intended?

[Dylan-M]

netbios is the first label only — no dots — so the existing ReplaceAll was a no-op and the CRL emitted DC=contoso instead of DC=contoso,DC=com. Pulled the domainToDC helper into domain.go (it's a domain-name string utility — lived in groups.go only because that's where it was first needed) and the CRL line now calls it. Test asserts the full DC chain in the CRL.