fix(ci): remove insecure git clone flag, add ca-certificates

Remove -c http.sslverify=false from all git clones
(enables proper TLS verification, closes MITM risk).
Explicitly install ca-certificates in every CI Docker image.

Dockerfile.arch

@@ -13,6 +13,7 @@ RUN pacman -S --needed --noconfirm \
   autoconf-archive \
   automake \
   base-devel \
+  ca-certificates \
   ccache \
   check \
   cmake \
@@ -64,7 +65,7 @@ USER root
 RUN pacman -U --noconfirm libstrophe-git/libstrophe-git-*.pkg.tar.zst
 
 WORKDIR /usr/src
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh