UX: Embed CA bundle as fallback (Better support for `FROM scratch` base image)

Presently `chisel` expects the CA bundle to exist externally to contact Github over HTTPS. It would be beneficial to have an embedded fallback (_even if opt-in via CLI flag_) instead of failing, as it simplifies `FROM scratch` image usage which can avoid an intermediary `--root` path + `COPY` from an earlier stage.

```Dockerfile
FROM scratch
SHELL ["/nu", "-c"]
# NOTE: `chisel` is a prior stage (no official image yet)
RUN --mount=type=bind,from=chisel,source=/usr/local/bin/chisel,target=/chisel \
--mount=type=bind,from=ghcr.io/nushell/nushell,source=/usr/bin/nu,target=/nu \
/chisel cut --release ubuntu-24.04 --root / base-files_base
```

```console
0.410 2025/04/26 01:52:05 Consulting release repository...
0.603 error: cannot talk to release repository: Get "https://codeload.github.com/canonical/chisel-releases/tar.gz/refs/heads/ubuntu-24.04": tls: failed to verify certificate: x509: certificate signed by unknown authority
```

The binary size should not increase that much and this would allow for running [`chisel` on `FROM scratch`](https://github.com/canonical/chisel/issues/220) without having to provide `ca-certificates.crt` upfront (_which can either add extra layer weight or conflict with `chisel` writing to the same location that's a temporary bind mount when using `--root /`_).

There is a Go package [`rootcerts`](https://github.com/breml/rootcerts) which can embed the CA bundle into the Chisel build? That will be used as a fallback when there is no trust store on the filesystem to leverage. I've not explored other options for approaching this, so there might be a better option if `rootcerts` is not something you're comfortable with.

---

**Reference:** Another user also pointed out the concern with an external CA bundle at the end of [this comment](https://github.com/canonical/chisel/issues/208#issuecomment-2779271111).

Start by tracing chisel's HTTPS release-repository request and its existing filesystem trust-store handling; the payload names no source file or test. Compare an embedded CA fallback such as rootcerts with other options, preserving the normal trust store and any opt-in behavior. Done means the shown FROM scratch workflow can contact GitHub without a filesystem CA bundle, with coverage for fallback and regular environments.

Written by the indexing model from the issue text.