deck dump --sanitise not treating ca_certificate id embedded in other entities (like service) properly

Instead of the id, a random string is added, causing failures in sync.
`HTTP status 400 (message: "schema violation (config.ca_certificates: {\n \"expected a valid UUID\"\n})")`

Start by reproducing the failure with `deck dump --sanitise` on a configuration where a `ca_certificate` ID is embedded in a service or another entity. Trace the sanitisation path and verify that the embedded ID remains a valid UUID, then confirm the resulting configuration can be synced without the schema violation.

Written by the indexing model from the issue text.