Make setting up private CA certificates easier

### Description

Suggest adding a default empty chain.pem to `/opt/flowfuse-device/`

And configuring both NSSM and Linux services to export the `NODE_EXTRA_CA_CERTS=/opt/flowfuse-device/chain.pem` environment variable by default.

This mean users would only need to overwrite the file with their CA chain to enable support.

I would like to do this for the flowfuse-device-agent shell scripts as well, but they are generated by npm from the package.json file and I don't think it's possible to inject env vars into them.

### Requested By

- Customer name and/or link to HubSpot contact

Start by inspecting the setup files for /opt/flowfuse-device/, the NSSM and Linux service definitions, and package.json generation for the flowfuse-device-agent shell scripts. Verify that a default empty chain.pem is installed and that the requested NODE_EXTRA_CA_CERTS value is configured for the supported services, while checking whether generated scripts can receive the environment variable.

Written by the indexing model from the issue text.