Rebuild Docker Hub images to pick up updated ca-certificates (distrusted intermediate CA) #6519

Summary

The published proxysql/proxysql images ship ca-certificates 20250419 (Debian trixie), which
still trusts the roots behind the eMudhra intermediate CA key compromise
(Debian #1151413, severity grave). Debian's fix,
ca-certificates 20260816+nmu1, blacklists "emSign ECC Root CA - G3" and "Comodo AAA Services
root", but so far it's only in unstable/testing. Trixie's 20250419+deb13u1 is pending in
stable-new.

Affected images

proxysql/proxysql:3.0.11 (digest sha256:0e95d1b7cc32f1de7923ffbf6cc4ba658874a6f6a6b7c2cdfdc6444304c13caf),
and by extension 3.0.11-debian, 3.0, 3, latest. The -centos variants are probably affected
too (not checked).

Evidence

    $ docker run --rm --entrypoint sh proxysql/proxysql:3.0.11 -c \
        'dpkg -l ca-certificates | tail -1; ls /usr/share/ca-certificates/mozilla | grep -E "emSign_ECC_Root_CA_-_G3|Comodo_AAA"'
ii  ca-certificates 20250419     all          Common CA certificates
Comodo_AAA_Services_root.crt
emSign_ECC_Root_CA_-_G3.crt

Request

1. Rebuild and republish the current release tags once Debian trixie ships the updated
   ca-certificates (or build with apt-get upgrade so the next rebuild picks it up automatically).
2. In the meantime, consider removing the two affected roots during the image build
   (prefix them with ! in /etc/ca-certificates.conf, then run update-ca-certificates), so
   users don't have to wait for the Debian point release.
3. Longer term, scheduled rebuilds would let OS security fixes reach users between ProxySQL releases.

Thanks for maintaining these images!