fix(docker-only): add Let's Encrypt Gen Y root certificates

[louislam]

As Let's Encrypt is rolling out Gen Y certs, it seems that we have to deal with the problem manually.

If you are using non-Docker, you may need to fix it manually by downloading the root certs.

Debian for example:

curl -fsSL https://letsencrypt.org/certs/gen-y/root-ye.pem -o /usr/local/share/ca-certificates/isrg-root-ye.crt
curl -fsSL https://letsencrypt.org/certs/gen-y/root-yr.pem -o /usr/local/share/ca-certificates/isrg-root-yr.crt
update-ca-certificates

Please follow this checklist to avoid unnecessary back and forth (click to expand)

• ⚠️ If there are Breaking change (a fix or feature that alters existing functionality in a way that could cause issues) I have called them out
• 🧠 I have disclosed any use of LLMs/AI in this contribution and reviewed all generated content.
  I understand that I am responsible for and able to explain every line of code I submit.
• 🔍 Any UI changes adhere to visual style of this project.
• 🛠️ I have self-reviewed and self-tested my code to ensure it works as expected.
• 📝 I have commented my code, especially in hard-to-understand areas (e.g., using JSDoc for methods).
• 🤖 I added or updated automated tests where appropriate.
• 📄 Documentation updates are included (if applicable).
• 🧰 Dependency updates are listed and explained.
• ⚠️ CI passes and is green.

[Copilot]

Pull request overview

Adds Let's Encrypt Gen Y root certificates (root-ye, root-yr) into the Debian base image's CA store, since Debian bookworm does not yet ship them. This ensures monitors and notification providers that perform TLS verification continue to trust sites using the new Let's Encrypt roots.

Changes:

• Download root-ye.pem and root-yr.pem from letsencrypt.org into /usr/local/share/ca-certificates/.
• Run update-ca-certificates to register them in the system trust store.

[JensSpanier]

I don’t think this is necessary:

Each of these new roots is intended to eventually replace its corresponding predecessor, and to that end we have cross-signed the new roots from the old ones.

https://letsencrypt.org/2025/11/24/gen-y-hierarchy.html

Also see current chains: https://letsencrypt.org/certificates/

[louislam]

@JensSpanier Yes, theoretically, but Let's encrypt indeed issued some invalid certs yesterday, which made me so confused.

See also:
#7450 (comment)