fix(proxy): support for system CA with mTLS certs

[brandtkeller]

Description

The use of the proxy registry mode (which notably added mTLS certs to the registry/proxy) enabled encryption of the image push logic - but when the registry is backed by an s3 storage backend and not configured to disable redirects uses the self-signed CA to perform the redirect to the S3 bucket and fails due to TLS handshake.

This adds the self signed CA to the system CA instead of solely creating a new cert pool.

Worth noting that this can be overcome by setting configuration on the registry to disable redirects and have the registry route all traffic.

Related Issue

Fixes #5075

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	1ecf618
🔍 Latest deploy log	https://app.netlify.com/projects/zarf-docs/deploys/6a56b8181f27c70008d58347

[codecov]

Codecov Report

❌ Patch coverage is 40.00000% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/pkg/pki/pki.go	40.00%	4 Missing and 2 partials ⚠️

Files with missing lines	Coverage Δ
src/pkg/pki/pki.go	60.67% <40.00%> (-0.96%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[AustinAbro321]

This makes perfect sense as a fix, nice work