fix: ensure PII is cleared from historical certificate records during retirement

[ttak-apphelix]

Description

GeneratedCertificate uses django-simple-history, which mirrors every row change into certificates_historicalgeneratedcertificate. This table stores the learner's full name in every snapshot. The existing retirement pipeline only blanked name in the live table — all prior audit snapshots retained the real name indefinitely.

This PR closes that gap:

• clear_pii_from_certificate_records_for_user() now also blanks name in the history table via GeneratedCertificate.history.filter(...).update(name="")
• purge_pii_from_generatedcertificates management command extended to also backfill the history table for all previously retired users(flag-gated)
• [config.py] — added [ENABLE_REDACT_HISTORICAL_PII_RETIREMENT] setting toggle
• pii_retirement annotation on GeneratedCertificate corrected from retained to local_api
• Tests updated to assert history table rows are cleared in both paths

Testing:
pytest lms/djangoapps/certificates/tests/test_api.py::CertificatesLearnerRetirementFunctionality
pytest lms/djangoapps/certificates/management/commands/tests/test_purge_pii_from_generatedcertificates.py

Jira ticket:
https://2u-internal.atlassian.net/browse/BOMS-590

[robrap]

Thanks.

[robrap]

Lots of simple changes. I gave it a bit more attention. Not everything would be blocking, but simple enough in most cases.

[robrap]

Nice job. I made two minor updates before merging.