Remove governance-managed CA bundles for outbound TLS

[Copilot]

CCF no longer needs enclave-managed Certificate Authorities for outbound TLS. Outbound TLS verification should use the host/container system trust store.

• JWT/JWK auto-refresh

  • Removed CA bundle lookup and CURLOPT_CAINFO_BLOB override.
  • Auto-refresh now relies on curl/OpenSSL default trust-store resolution.
  • New JWT issuer proposals no longer persist ca_cert_bundle_name; legacy metadata remains readable but ignored.

• Governance surface

  • Removed set_ca_cert_bundle / remove_ca_cert_bundle actions from sample constitutions.
  • Removed CA bundle reporting from /gov/service/jwk.
  • Updated governance OpenAPI schemas and examples.

• Outbound HTTPS hardening

  • Quote endorsement HTTPS fetches now verify peer certificates instead of disabling verification.
  • TLS trust failures log guidance to check the system trust store or SSL_CERT_FILE.

• Docs and tests

  • Updated JWT auto-refresh docs to describe system trust-store requirements.
  • Updated JWT tests to use SSL_CERT_FILE for local self-signed issuer trust.
  • Removed obsolete CA bundle storage tests.

[eddyashton]

@copilot Revert changes to these versioned, shipped OpenAPI docs - we cannot change the schema for these. If we're dropping the functionality, but need to retain schema compatibility, then we could always return empty objects. Likely the correct fix is a new API version that omits the field, but don't tackle that now.

[Copilot]

Addressed in e9b199d by restoring the shipped JWK OpenAPI schema/example files and keeping /gov/service/jwk schema-compatible with an empty caCertBundles object.

[eddyashton]

@achamayou makes a good point - its very rude to land this in a 7.x patch release, this is only targeting 8.0.