fix(network): support WPA3 SAE connections

[g1ibby]

Summary

• Preserve NetworkManager's SAE capability from access-point discovery through activation.
• Select sae for SAE-capable access points and retain wpa-psk for WPA2-Personal access points.
• Prefer SAE for WPA2/WPA3 transition-mode access points.
• Preserve the selected BSSID's SAE capability during SSID deduplication.
• Refresh cached control-center network rows when the advertised SAE capability changes.

Motivation

First-time connections to WPA3-Personal/SAE-only access points failed because Noctalia reduced NetworkManager's WPA/RSN capability flags to a generic secured value and always created secured connections with:

802-11-wireless-security.key-mgmt = wpa-psk

SAE-only access points require:

802-11-wireless-security.key-mgmt = sae

This change preserves the SAE capability of the selected NetworkManager access-point object through discovery, deduplication, password prompting, and activation. WPA2 access points continue to use WPA-PSK.

The network panel's cached row identity now also includes SAE capability. If an existing SSID's advertised capability changes while the panel remains open, the row is rebuilt with the current AccessPointInfo instead of activating with stale key management.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring
• Build / packaging

Related Issue

Fixes #3841

Testing

Ran the focused regression in the Nix development environment:

nix develop --command just test debug network_manager_security --print-errorlogs

Result:

network_manager_security: 1/1 passed

Manual Coverage

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Tested with different bar positions and density settings
• Tested at different interface scaling values
• Tested with multiple monitors

Screenshots / Videos

Checklist

• This PR is ready for review, or it is marked as Draft.
• I read and followed the relevant guidance in CONTRIBUTING.md.
• I ran just format with clang-format v22+ installed, or this PR has no code changes.
• I ran the relevant build or test commands, or explained why they were not run.
• I self-reviewed the changes.
• I checked for new warnings or errors.
• I will update end-user documentation after merge, or this PR does not change user-facing configuration or behavior.
• I added or updated assets/translations/en.json, or this PR adds no new user-facing strings.
• I did not edit non-English translation files unless this PR is explicitly for translation tooling, an import/export sync, or a maintainer-requested locale change.
• I used the existing canonical names for config keys, IPC names, paths, and identifiers.

Additional Notes

The NetworkManager SAE bit and key-management mapping are kept together in a small allocation-free helper. This gives production code and regression tests one source of truth without requiring D-Bus or a running NetworkManager instance in the focused test.
Other network backends retain their existing behavior because AccessPointInfo::supportsSae defaults to false.
When multiple BSSIDs advertise the same SSID, Noctalia retains the SAE capability of the selected representative access-point object rather than combining capabilities across BSSIDs. This matches the access-point object passed to AddAndActivateConnection2.

[ItsLemmy]

[P2] Include supportsSae in the control-center row identity

src/shell/control_center/tabs/network_tab.cpp:817-827

The PR body says cached rows are rebuilt when SAE capability changes, but NetworkTab::structureKey() still keys each row only on SSID, secured, active, and saved status. AccessPointRow stores its own AccessPointInfo, while syncLiveMetrics() updates only signal strength.

Therefore, if a refresh changes the selected BSSID from WPA2 to SAE—or the same BSSID changes from transition mode to SAE-only, without changing those existing key fields, the row is retained with stale supportsSae. Clicking it then calls activateAccessPoint() with the old value and can still submit key-mgmt = wpa-psk, reproducing the failure this PR addresses.

Add ap.supportsSae to structureKey(), as the PR description already intends. The focused helper test does not exercise this discovery → row cache → activation path, which is why the omission passes.

[g1ibby]

@ItsLemmy You're right. I had already added ap.supportsSae to NetworkTab::structureKey() in a local follow-up commit, forgot to push it. That's why the PR description and remote diff were out of sync. I pushed commit

[ItsLemmy]

Thanks!