refactor: finish chef_ca migration

[damacus]

Summary

• make the chef_ca custom resource the sole public interface and remove root attributes/recipes
• move remaining helper-only path logic into libraries/chef_ca.rb and drive behavior through explicit resource properties
• modernize ChefSpec, InSpec, docs, and kitchen/CI support for the migrated structure

Verification

• berks install
• cookstyle
• /opt/chef-workstation/embedded/bin/rspec --format documentation
• DOCKER_HOST=unix:///Users/damacus/.docker/run/docker.sock KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen test default-ubuntu-2204 --destroy=always

[github-actions]

Slowest examples

Top 10 slowest examples (0.11 seconds, 100% of total time)

Example	Description	Time in seconds
spec/unit/resources/chef_ca_spec.rb:23	chef_ca on Ubuntu appends to the default Chef Infra Client cacert path	0.0451
spec/unit/resources/chef_ca_spec.rb:44	chef_ca with a custom target path uses the explicit path override	0.03249
spec/unit/resources/chef_ca_spec.rb:65	chef_ca on Windows targeting Chef Workstation computes the Chef Workstation cacert path	0.01718
spec/unit/libraries/chef_ca_spec.rb:22	ChefCA::Helpers#cacert_path_for computes the Chef Infra Client path on Linux	0.012
spec/unit/libraries/chef_ca_spec.rb:40	ChefCA::Helpers#bundle_installed? returns false when the target file is missing	0.00288
spec/unit/libraries/chef_ca_spec.rb:44	ChefCA::Helpers#bundle_installed? returns true when the bundle already exists	0.00037
spec/unit/libraries/chef_ca_spec.rb:26	ChefCA::Helpers#cacert_path_for computes the Chef Workstation path on Windows	0.00026
spec/unit/libraries/chef_ca_spec.rb:30	ChefCA::Helpers#cacert_path_for retains legacy ChefDK targeting	0.00024
spec/unit/libraries/chef_ca_spec.rb:56	ChefCA::Helpers#bundle_entry formats the appended certificate block	0.00021
spec/unit/libraries/chef_ca_spec.rb:34	ChefCA::Helpers#cacert_path_for uses an explicit cacert path override	0.0002