feat: filter out ESC3 false positives

[JonasBK]

Description

Prevent creating ADCSESC3 edges from users if they cannot enroll due to CertTemplate requirement for DNS name.

Motivation and Context

We should stop creating ADCSESC3 edges from user nodes if the enrollment agent certificate template requires a DNS name, as users cannot enroll in such a cert template.

How Has This Been Tested?

Tested by uploading ESC3 data with and without the DNS requirement.
Also ran "just test -a".

Screenshots (if appropriate):

Types of changes

• Chore (a change that does not modify the application functionality)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Documentation updates are needed, and have been made accordingly.
• I have added and/or updated tests to cover my changes.
• All new and existing tests passed.
• My changes include a database migration.