feat(nomad-aws,nomad-gcp): add custom CA certificate support for Docker

[denislemire]

Summary

Add support for installing custom CA certificates on Nomad client hosts, allowing Docker to pull images from registries that use certificates signed by custom/private CAs.

Problem

Previously, custom CA certificates could only be passed to job containers via the helm chart's tls.certificate setting and CCI_ADDITIONAL_CA_CERTS_PATH environment variable. However, this only works after containers start - it doesn't help the Docker daemon on the host pull images in the first place.

This caused job failures (Exit Code 1) in environments with:

• Corporate TLS-inspecting proxies
• Private Docker registries with self-signed certificates
• Air-gapped environments with internal CAs

Solution

Add a new custom_ca_cert variable that:

1. Accepts a PEM-formatted CA certificate
2. Installs it to /usr/local/share/ca-certificates/ during cloud-init
3. Runs update-ca-certificates to add to system trust store
4. Restarts Docker daemon to pick up the new CA

Usage

module "nomad" {
  source = "git::https://github.com/CircleCI-Public/server-terraform.git//nomad-aws"
  # ... other variables ...
  
  custom_ca_cert = file("path/to/ca-cert.pem")
}

Changes

• nomad-aws/variables.tf - Added custom_ca_cert variable
• nomad-aws/main.tf - Pass variable to template
• nomad-aws/template/nomad-startup.sh.tpl - Install CA, update trust store, restart Docker
• nomad-aws/README.md - Added usage example
• nomad-gcp/variables.tf - Added custom_ca_cert variable
• nomad-gcp/main.tf - Pass variable to template
• nomad-gcp/templates/nomad-startup.sh.tpl - Install CA, update trust store, restart Docker

Test Plan

• Deploy Nomad clients with custom_ca_cert set
• Verify CA is installed at /usr/local/share/ca-certificates/circleci-custom-ca.crt
• Verify docker pull works for images from registry using the custom CA
• Verify backward compatibility when custom_ca_cert is not set (empty string)