Add the `invalidation_reason` field to the `ExternalCertificate` model and implement the invalidation mechanism.