comp AP gateway: convert pubsub item retractation to AP `Delete` activity: when an item `retract` is received from a node from which an AP actor is subscribed, a corresponding `Delete` activity is created and sent to AP followers. Trying to retract an item from a virtual node of the gateway pubsub service now return a `forbidden` stanza error (those nodes are handled on AP side and thus are not owned by XMPP entities). rel 367

this certificates are used to enable TLS during tests. Those must be the same as in
backend_e2e (they are generated there)