CP-49147: Reduce size of the pool record (uefi_certificates)

[edwintorok]

This field is very big and part of every pool.get_all_records() call (done by SM), which is currently >64KiB in size.

TODO: the Changed field needs to match the (future!) tag that this will receive. Hence draft.

[lindig]

The idea is that very few clients will need the certificate and can use a new API call to obtain it. The existing field is replaced by a digest.

This seems fine with me as long as we control the relevant clients.

[lindig]

I would like to see this merged because UEFI takes up a lot of data in records.

[contificate]

I'd also like to see this change merged.

[contificate]

Upon a second look over this PR, I am concerned about the change to "internal only". My understanding is that internal only fields affect what is seen in snapshots.

The API records manipulated internally comprise every field, but my understanding is that DB actions (generated) for get_record etc. exclude those fields (since they're typically things like related session references).

We should change the meaning of the field, but not its visibility to API users (which I fear this PR may have done accidentally).

[robhoes]

I agree with @contificate. Making existing fields internal_only:true is similar to removing the field from the API and is backwards incompatible. It may also break rolling updates.