fix: preserve CA certificate references when sanitizing

[Shubham-Padkonde]

Sanitizing a dump preserves CA certificate IDs but currently hashes references to those IDs in Services and plugin configuration. This leaves the sanitized configuration pointing at certificates that do not exist and can prevent it from being imported.

Preserve Service.CACertificates and plugin ca_certificates references, consistent with the existing CA certificate ID exemption. The regression exercises both reference locations and checks that unrelated service/plugin values and certificate contents are still sanitized.

Fixes #1830.

Validation:

• The regression failed for both references before the fix.
• Linux Go 1.26.6: go test -race -count=1 ./... passed.
• Linux Go 1.27.1: go test -race -count=1 ./... passed.
• Pinned golangci-lint v2.11.4 under Go 1.26.6: 0 issues.
• git diff --check passed.

External Kong/Konnect integration tests requiring services or credentials were not run.

Prepared with Codex assistance.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}