[fix] Fixed VPN server backend validation logic

Bug:
The validation logic prevented changing of VPN server's backend
if any VpnClients were present for the it. But the logic didn't
compare backend value of the object with what has been store in
the database.

Fix:
The validation logic compares backend values before raising
ValidationError.

openwisp_controller/config/base/vpn.py

@@ -140,7 +140,12 @@ def clean(self, *args, **kwargs):
     def _validate_backend(self):
         if self._state.adding:
             return
-        if self.vpnclient_set.exists():
+        if (
+            'backend' not in self.get_deferred_fields()
+            and self._meta.model.objects.only('backend').get(id=self.id).backend
+            != self.backend
+            and self.vpnclient_set.exists()
+        ):
             raise ValidationError(
                 {
                     'backend': _(

openwisp_controller/config/tests/test_vpn.py

@@ -593,19 +593,27 @@ def test_change_vpn_backend_with_vpnclient(self):
         config.templates.add(template)
         self.assertEqual(VpnClient.objects.count(), 1)
 
-        with self.assertRaises(ValidationError) as context_manager:
-            vpn.backend = self._BACKENDS['wireguard']
-            vpn.subnet = subnet
-            vpn.full_clean()
-            vpn.save()
-        expected_error_dict = {
-            'backend': [
-                'Backend cannot be changed because the VPN is currently in use.'
-            ]
-        }
-        self.assertDictEqual(
-            context_manager.exception.message_dict, expected_error_dict
-        )
+        with self.subTest(
+            'Test validation error is not raised when backend is unchanged'
+        ):
+            try:
+                vpn.full_clean()
+            except ValidationError as error:
+                self.fail(f'Unexpected ValidationError: {error}')
+
+        with self.subTest('Test validation error is raised when backend is changed'):
+            with self.assertRaises(ValidationError) as context_manager:
+                vpn.backend = self._BACKENDS['wireguard']
+                vpn.subnet = subnet
+                vpn.full_clean()
+            expected_error_dict = {
+                'backend': [
+                    'Backend cannot be changed because the VPN is currently in use.'
+                ]
+            }
+            self.assertDictEqual(
+                context_manager.exception.message_dict, expected_error_dict
+            )
 
 
 class TestWireguardTransaction(BaseTestVpn, TestWireguardVpnMixin, TransactionTestCase):