notify-push: trust the CAs from NEXTCLOUD_TRUSTED_CACERTS_DIR

[h4fnp]

The push server reaches Nextcloud at its public URL. Behind a reverse proxy that terminates TLS with a private CA, it rejects the certificate (UnknownIssuer) and the self-test fails at "push server can connect to the Nextcloud server", so no client can authenticate.

Mount the user-provided CA directory into the notify-push container as the Nextcloud and Talk containers already do. The container is read-only, so start.sh builds a bundle from the system store and the mounted certificates in /tmp (now a tmpfs) and points the TLS stack at it via SSL_CERT_FILE, the same way the Talk container does.

Assisted-by: ClaudeCode:claude-fable-5-1

• Resolves: NEXTCLOUD_TRUSTED_CACERTS_DIR - Not mounted in notify_push container #8316 / NEXTCLOUD_TRUSTED_CACERTS_DIR - Not mounted in notify_push container #8322

Summary

• The PR was tested and verified that it works locally
• Or will be tested after merge on a dedicated test instance (available for maintainers)
• Sign-off message is added to all commits
• Tests (playwright if possible) are included
• Screenshots before/after for front-end changes
• Documentation has been updated or is not required
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone next added

AI (if applicable)

• The content of this PR was partly or fully generated using AI