Support addition of ca-certificates via secrets

[etsauer]

Rather than baking a PEM file into our main docker image to add a trusted certificate, we should be mounting those into the container at runtime, and use a start script to run the update-ca-certificates command.