fix: make certificate automation deployable and restrict it to core and above

[Kanavpreet-Singh]

1. Gmail credentials cannot be supplied in a deployment

MassMailService read the Gmail client ID and secret from src/main/resources/secret.json. That file is gitignored, so it is absent from the repository and from the jar our Docker image builds. Certificate mailing works on a machine that happens to have the file locally, and always fails once deployed.

• Client ID and secret now come from configuration, like the database and SMTP credentials.
• All four Gmail properties default to empty so a deployment without certificate support still starts.
• The mass mail job fails with an explicit message naming the missing variables.
• Your validateGmailConfig startup check is kept, rewritten to validate the properties rather than secret.json.

Requires four environment variables, all stored as secrets: GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, GMAIL_REFRESH_TOKEN, GMAIL_USER_EMAIL.

2. The certificate APIs were reachable without authentication

/api/certificates/**, /api/templates/** and /ui were granted permitAll with no @PreAuthorize. With no token it was possible to create certificates, upload a template, import a CSV and start the mass mail job, which on a public deployment would let anyone send email from the ACM account.

Added @PreAuthorize(Constants.HAS_ROLE_CORE_AND_ABOVE) to the three controllers, matching the roles that manage events, and declared at class level so a new endpoint is not left open by accident.

Verified against a local run, every endpoint that previously answered anonymously with 200 now returns 403, while /health and other public endpoints are unchanged.

Also stops tracking target/, so build output no longer shows as pending changes.

Note on /ui

The portal is a server rendered page with no login of its own, and the project authenticates with a bearer token header, so /ui in a browser now returns 403. It needs a login flow before it can be used that way. Leaving it public was not a safe alternative since it can start the mass mail job, but happy to change the approach if you would prefer it keep working in the browser short term.