Resolve Git Bash explicitly, and skip on a missing privilege or tool

Fifteen tests failed on this workstation and had been written off as
environmental. Thirteen of them were not.

Those thirteen ran subprocess.run(['bash', ...]). shutil.which('bash') finds
System32\bash.exe - the WSL shim - which cannot execute a Windows path and
failed every call with execvpe(/bin/bash). They now locate Git Bash from
git.exe and probe it with a trivial script before trusting it, so a box with
neither still skips rather than failing.

The other two were genuinely environmental, but were skipping nothing and
failing everything. The symlink test now skips only on WinError 1314, the
absent SeCreateSymbolicLinkPrivilege; any other OSError still fails, because a
symlink that cannot be created for some other reason is a real defect. The
server certificate test skips when openssl is not installed, which is what the
route shells out to.

Being labelled environmental is why these sat for weeks. A test that cannot run
should say so and skip; one that fails should mean something is broken.

tests/test_plugins/test_endpoints_credentials.py

@@ -7,6 +7,8 @@ different PC is refused (ASSET_MISMATCH), the shared key is refused for that PC
 (CREDENTIAL_INVALID) so the agent knows to enroll again.
 """
 
+import shutil
+
 import pytest
 
 from shopdb.core.models import Asset, AssetType, AuditLog, Setting
@@ -882,6 +884,8 @@ def test_approve_refuses_an_enrolled_computer(client, db, app, keyheaders,
 
 # -- server certificate pin --------------------------------------------------
 
+@pytest.mark.skipif(shutil.which('openssl') is None,
+                    reason='needs the openssl binary on PATH')
 def test_server_cert_reports_the_spki_pin(client, db, auth_headers, tmp_path,
                                           monkeypatch):
     import hashlib