Add `proxy_ca_certificate_file` output to `start-proxy` action

[mbg]

I figured it would be useful to avoid duplicating this across different extractors that e.g. set SSL_CERT_FILE for relevant sub-processes. That's currently done by the C# extractor and looks like will be done by the Go extractor as well. By doing it in the action, we can avoid duplicating this process in those extractors.

Notes/questions for reviewers

• We might take this opportunity to add corresponding cleanup logic here as well.
• Currently, the implementation is such that we continue as before if writing the file fails, but we should probably just fail hard to guarantee that the file has been written if the proxy is initialised.

Merge / deployment checklist

• [ ] Confirm this change is backwards compatible with existing workflows.
• [ ] Confirm the readme has been updated if necessary.
• [ ] Confirm the changelog has been updated if necessary.