bundlereader: merge PROXY_CA_BUNDLE into CABundle for HTTPS git clones

[p-se]

gitDownload now appends PROXY_CA_BUNDLE to auth.CABundle before passing the combined PEM to go-git's CloneOptions.CABundle, so that git::https:// repos cloned through an HTTPS proxy with a custom CA certificate are trusted. A defensive copy of auth.CABundle is made to avoid mutating the caller's slice.

Refers to #4869

Additional Information

Checklist

• I have updated the documentation via a pull request in the fleet-product-docs repository.

[Copilot]

Pull request overview

Updates bundlereader’s go-git clone path to trust custom HTTPS proxy CAs by merging PROXY_CA_BUNDLE into the effective CA bundle passed to go-git, aligning helm.chart git downloads with existing proxy CA support elsewhere in the codebase.

Changes:

• Append PROXY_CA_BUNDLE to auth.CABundle (via a defensive copy) before setting go-git CloneOptions.CABundle.
• Expand/clarify gitDownload TLS/proxy behavior documentation.
• Add unit tests covering PROXY_CA_BUNDLE-only and merged CA bundle scenarios.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/bundlereader/gitclone.go	Merges PROXY_CA_BUNDLE into the CA bundle passed to go-git clone options.
internal/bundlereader/gitclone_test.go	Adds tests verifying PROXY_CA_BUNDLE merge behavior during TLS verification.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.