[FEATURE]: Support custom CA certificate path for remote repository connections

[Josh-Tracy]

Conjure does not support defining custom CA certificate paths or setting insecure options. Conjure uses the system certificate store to verify TLS. If the remote repository server uses a private CA, the TLS handshake fails because Go can't find that CA in the system store.

The user gets an error like:
  failed to fetch index: Get "https://internal.example.com/templates/index.json":
  x509: certificate signed by unknown authority

There is no workaround in Conjure itself. The only current option is to install the CA certificate into the OS-level trust store, which may require admin/root privileges and isn't always feasible in locked-down enterprise environments.

Proposed Solution

Add a configuration option to specify a path to a PEM-encoded CA certificate file that Conjure will trust in addition to the system certificates.

Config file (~/.conjure.yaml):
ca_cert: /path/to/internal-ca.pem

Environment variable:
CONJURE_CA_CERT=/path/to/internal-ca.pem

• New ca_cert config field accepted via config file, environment variable, and optionally CLI flag
• PEM-encoded CA certificate is loaded and appended to the system certificate pool
• Connections to servers signed by the provided CA succeed
• Connections to servers signed by system CAs continue to work (not replaced, appended)
• Invalid cert path or malformed PEM produces a clear, actionable error
• No impact when ca_cert is not set (default behavior unchanged)
• Unit tests cover: valid CA, invalid path, malformed PEM, unset (default)