Use AL2 for bundled CA certificates

This pulls in the Amazon Linux 2 CA certificates bundle to be used by
the update operator instead of relying on the bundles that are/were in
the building container's filesystem.

Dockerfile

@@ -19,9 +19,13 @@ RUN go mod download
 COPY ./ /src/
 RUN make -e build GOBIN=/ CGO_ENABLED=0
 
+# Use certificates from Amazon Linux 2
+FROM amazonlinux:2 as al2
+
 # Build minimal container with a static build of the update operator executable.
 FROM scratch as update-operator
-COPY --from=build /etc/ssl /etc/ssl
+COPY --from=al2 /etc/ssl /etc/ssl
+COPY --from=al2 /etc/pki /etc/pki
 COPY --from=build /src/COPYRIGHT /src/LICENSE-* /usr/share/licenses/bottlerocket-update-operator/
 COPY --from=licenses /licenses/ /usr/share/licenses/bottlerocket-update-operator/vendor/
 COPY --from=build /bottlerocket-update-operator /