Renew a device certificate

Called by the MineOS device agent before its certificate expires; you do not call this endpoint yourself. The agent
authenticates with its current device certificate and submits a new certificate signing request for the same device id.

Responses: 201 with the same body as enrollment; 400 when the signing request cannot be processed;
403 — { "reason": "identity_mismatch" } when the request is for a different device than the certificate;
403 without a valid device certificate; 503 — { "status": "degraded" } when issuance is temporarily
unavailable.