feat: corporate CA trust for pipeline git-clone from internal hosts

[minmzzhang]

Add support for the git-clone task to trust corporate/internal CA certificates when cloning from private Git servers (e.g. GitLab behind a corporate CA).

Supply-chain chart:

• Add conditional ssl-ca-directory workspace to pipeline and pipelinerun templates (gated by git.sslCABundle.enabled)
• Add git.sslCABundle values (enabled, configMapName) defaulting to the ztvp-trusted-ca ConfigMap
• Set CRT_FILENAME param so git-clone finds the CA bundle file

ztvp-certificates chart:

• Auto-detect internal Git hosts via customCA.remoteHosts: the extraction Job connects to the host on port 443, extracts the full CA chain from the TLS handshake, and merges it into the bundle
• Distribute ztvp-trusted-ca to the pipeline namespace via the targetNamespaces list

Generator (gen-feature-variants.py):

• Auto-enable git.sslCABundle and customCA.remoteHosts when --git-repo points to a non-public host (not github.com/gitlab.com/bitbucket.org)
• Add git.sslCABundle.enabled to the protected-repos feature fragment and to the commented-out overrides in the base values-hub.yaml

values-hub.yaml:

• Replace hand-edited file with gen-feature-variants output for consistent indentation and complete feature composition

Documentation:

• Add "Corporate CA trust for internal Git hosts" section to docs/supply-chain.md covering enablement, auto-extraction, and manual CA provisioning alternatives