Clarify Host vs Guest PKI settings

**Path to page with content (_do not_ include domain name):**

/en/os/1.16.x/api/settings/pki/#pki_bundle-name_data

**What content is incorrect?**

Nothing.

**What should the content say or communicate?**

It should be made clear that the Bottlerocket settings for PKI only update the host machine’s CA Certificates, and that workloads (aka runnings containers) will have to have their own mechanisms.

Open /en/os/1.16.x/api/settings/pki/#pki_bundle-name_data and review the PKI settings content. Update the explanation so it clearly distinguishes host CA certificates from workload or container certificate management. Done means readers understand that Bottlerocket settings affect only the host and that workloads need their own mechanisms.

Written by the indexing model from the issue text.