There are specific FLEET_VAR_* that are required for certificate templates. We should validate that we have a valid set of them in the subject name.
Here is the comment #35788 (comment) in reference to it.

💥  Actual behavior

A user can put any FLEET_VAR_* in the subject name.

🛠️ To fix

There is a specific set that is require for certificate templates. Validate this on gitops runs as to minimize errors further down stream processing certificate templates.

related to #35460
yaml spec #35270