docs(onpremise): Document adding custom CA roots

[Spice-King]

Result of poking and prodding from getsentry/sentry#26851
Documentation for getsentry/self-hosted#1015

[vercel]

@Spice-King is attempting to deploy a commit to the Sentry Team on Vercel.

A member of the Team first needs to authorize it.

[BYK]

This is awesome thank you so much!!!

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/sentry/develop/BCXCmZMxzvQGEVUhYAdKxkS2j3G4
✅ Preview: https://develop-git-fork-spice-king-custom-ca-roots.sentry.dev

[chadwhitacre]

If I use custom CA roots, do those override or extend the system roots? Whichever it is, we should document that here.

[chadwhitacre]

If I use custom CA roots, do those override or extend the system roots?

If I'm reading the docs for update-ca-certificates right, the answer is that it extends the system roots:

Furthermore all certificates with a .crt extension found below /usr/local/share/ca-certificates are also included as implicitly trusted.

[chadwhitacre]

LGTM, bounced CI ...

[BYK]

Failure is same on master so merging.