fix(ci): remove insecure git clone flag, add ca-certificates

Remove -c http.sslverify=false from all git clones
(enables proper TLS verification, closes MITM risk).
Explicitly install ca-certificates in every CI Docker image.

Dockerfile.tumbleweed

@@ -10,6 +10,7 @@ RUN zypper --non-interactive in --no-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -49,7 +50,7 @@ ENV TERM=xterm
 RUN mkdir -p /usr/src
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr --disable-dependency-tracking