add OpenVpnBuilder with validation

[cachebag]

part of #288. depends on OpenVpnConfig being merged.

changes

new file: api/builders/openvpn_builder.rs

fluent builder that constructs OpenVpnConfig. validates at build time:

• remote must be set and non-empty
• auth_type must be set
• if Password or PasswordTls: username required
• if Tls or PasswordTls: ca_cert, client_cert, client_key required
• port 1-65535 if set

methods: new(name), remote(), auth_type(), username(), password(), ca_cert(), client_cert(), client_key(), key_password(), port(), tcp(), cipher(), auth(), dns(), mtu(), uuid(), autoconnect(), options(), build() -> Result<OpenVpnConfig>

re-export from builders/mod.rs.

tests

unit tests mirroring wireguard_builder.rs structure — required field checks, validation errors, happy paths.

[stoutes]

I'll take this one

[cachebag]

@stoutes sounds good. please remember to rebase, I am about to land #296 in PR #323 .