Ship a CA bundle in the image so single sign-on can reach the provider

The image is built FROM scratch and carried only the binary, so it had no
trust store, and every HTTPS call failed with "x509: certificate signed by
unknown authority". Nothing needed one until v0.29.0: OIDC discovery and the
token exchange are HTTPS calls to the identity provider, and the first
sign-in against Authentik died in discovery. The tests could not see it,
because they run on the host, whose trust store is fine.

The builder's ca-certificates.crt is copied in by name, so a missing file
fails the build instead of shipping an image that cannot sign anybody in.
Verified by fetching the provider's discovery URL from a scratch image with
and without the bundle: the same x509 error, then 200.

Password login and everything that talks only to Postgres were unaffected.

Dockerfile

@@ -16,6 +16,12 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
     go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut
 
 FROM scratch
+# scratch has no trust store, and a Go binary on it fails every HTTPS call with
+# "x509: certificate signed by unknown authority". Nothing needed one until single
+# sign-on: discovery and the token exchange are HTTPS calls to the identity provider.
+# The bundle is the builder's, copied by name so a missing file fails the build
+# rather than shipping an image that cannot sign anybody in.
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=builder /terdut /terdut
 EXPOSE 8080
 ENTRYPOINT ["/terdut"]