[client] Compare the client certificate paths before reporting a change

apply() assigned the incoming mTLS certificate and key paths and set updated
unconditionally, without comparing them to what the config already held. It is
the same presence-instead-of-value mistake this branch set out to fix, one
layer down: a caller restating its own certificate paths was reported as
changing them, which trips the value-aware update-settings gate.

Reported by cubic-dev-ai on PR #7398.

client/internal/profilemanager/config.go

@@ -708,12 +708,15 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.ClientCertKeyPath != "" {
+	// Compared, not just assigned: restating the path a config already holds
+	// changes nothing, and reporting it as an update makes a caller that
+	// re-sends its own configuration look like one asking to change it.
+	if input.ClientCertKeyPath != "" && input.ClientCertKeyPath != config.ClientCertKeyPath {
 		config.ClientCertKeyPath = input.ClientCertKeyPath
 		updated = true
 	}
 
-	if input.ClientCertPath != "" {
+	if input.ClientCertPath != "" && input.ClientCertPath != config.ClientCertPath {
 		config.ClientCertPath = input.ClientCertPath
 		updated = true
 	}

client/internal/profilemanager/config_would_change_test.go

@@ -275,3 +275,30 @@ func TestWouldChangeWithoutAStoredSyncMessageVersion(t *testing.T) {
 	require.True(t, changed)
 	require.Nil(t, cfg.SyncMessageVersion, "the dry run set the version on the stored config")
 }
+
+// Restating the certificate paths a config already holds is not a change, for
+// the same reason restating any other value is not.
+func TestWouldChangeIgnoresRestatedCertificatePaths(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mtls.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:        path,
+		ManagementURL:     "https://api.netbird.io:443",
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+	require.False(t, changed, "the stored certificate paths were restated")
+
+	changed, err = cfg.WouldChange(ConfigInput{ClientCertPath: "/etc/netbird/other.crt"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different certificate path is a change")
+}