Base URL of the provisioning API.
The device's existing token credential, used to authenticate the enrollment request.
Optionalrequest: EnrollRequestOptional certificate label/lifetime.
EnrollError when credential has no token, or the endpoint
is unreachable or rejects the CSR.
Generate a key/CSR and submit it to obtain an mTLS certificate credential, returning a new DeviceCredential with
kind: "cert"ready for persistence and connecting.