fix(helm): set SSL_CERT_FILE alongside REQUESTS_CA_BUNDLE when root-ca is mounted

[CL-SHLOMIKONCHA]

Summary

• Add SSL_CERT_FILE to the mapproxy container env, right under REQUESTS_CA_BUNDLE and NODE_EXTRA_CA_CERTS, under the same .Values.global.ca.secretName condition and pointing at the same mounted root-ca path ({{ global.ca.path }}/{{ global.ca.key }}).

Why

• REQUESTS_CA_BUNDLE is honored only by the requests library itself. Plain urllib3 (used directly by MapProxy's HTTP client) never reads it — verified in practice: TLS sources behind the private CA still failed verification with only REQUESTS_CA_BUNDLE set.
• SSL_CERT_FILE works one level lower: it is picked up by Python's ssl module via OpenSSL's default verify paths. When urllib3 builds an SSL context without an explicit ca_certs, it calls load_default_certs(), which honors SSL_CERT_FILE — so this covers plain urllib3 and anything else falling through to ssl defaults (http.client, urllib.request, redis-py TLS, ...).
• Note: boto3/botocore is covered by neither — it passes its own bundled certifi CA file explicitly. If the S3 endpoint uses the private CA, AWS_CA_BUNDLE would additionally be needed (not part of this PR).

Testing

• helm lint passes (pre-existing mclabels dependency warning only).