Roll out eMudhra incident fixes (Go, base images, trust stores) #78

Why

eMudhra intermediates are compromised -> https://go.dev/blog/emudhra-incident. Everything that ships its own trust store keeps trusting them until its updated and redeployed:

• Go binaries: verifier is statically linked, Go 1.27.3 / 1.26.10 block the intermediates in crypto/x509. Linux is the important case, there Go uses its own verifier, not the OS.
• Base images: ca-certificates bundle baked into the image
• Python certifi, Rust webpki-roots: ship their own root lists (emSign roots)
• CI tooling / installers that bundle certs

What

Update every trust path we ship, then cut and roll out new images.

• Every repo below is on Go >= 1.27.3 / 1.26.10, a current base image and trust stores without the emSign / eMudhra roots
• New images are released and deployed

Where

Go toolchain

• artifact-conduit: #522
• dependency-controller: #204
• quota-controller: #63
• apiserver-kit: #151
• solution-arsenal: #898
• machine-controller-manager-provider-hcloud: #3 (1.26.10)
• gardener-extension-provider-hcloud: #87 (1.26.10)
• ocm-kit: #109, #112, #113 (open)
• krop-controller: #55

Base images

• machine-controller-manager-provider-hcloud: #3 (distroless debian13)
• gardener-extension-provider-hcloud: #87 (static-debian13), #88 (hcloud CSI / CCM images)

Python / Rust trust stores

• artifact-conduit: #538 (certifi)
• solution-arsenal: #906 (certifi)
• knot: #43 (webpki-roots)

CI / tooling

• dev-kit: chore(deps): update cachix/install-nix-action action to v31.11.3 #76 (install-nix-action certs)

Notes

• List comes from PR search, not from checking each repo's go.mod, Dockerfiles or lockfiles, so repos without a fix PR may be missing. Base images of the other repos are not checked yet