Add NGTSConnection for Palo Alto Networks Next-Gen Trust Security, a
VaaS-derived backend that reuses CloudConnection's outagedetection/v1
REST endpoints but differs in authentication and zone format:

- Auth: Strata Cloud Manager OAuth2 client-credentials via a service
  account (client_id/client_secret/tsg_id), sent as a Bearer token and
  auto-refreshed ahead of the ~15-min expiry, instead of the api-key
  header.
- Zone: a Certificate Issuing Template alias only (no Application\CIT
  split); requests omit applicationId.
- Base and token URLs are environment-specific and must be supplied
  (no hardcoded default).

Wire NGTSConnection into venafi_connection (auto-detected from
token_url + client_id + client_secret, or platform=VenafiPlatform.NGTS)
and add the VenafiPlatform.NGTS enum and NGTS fields on Authentication.

Add a usage example, live tests (tests/test_ngts.py, gated on NGTS_*
env vars) and offline unit tests, and ignore generated cert material.