Add ca-certificates to fix s2s TLS verification

Without CA certs, Prosody cannot verify remote servers' certificates,
causing all server-to-server connections to fail with "not trusted".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -8,6 +8,7 @@ RUN apt-get update --fix-missing && \
     lua-sec \
     lua-unbound \
     openssl \
+    ca-certificates \
     netcat-traditional \
     && rm -rf /var/lib/apt/lists/*