The extractor ran `git config --global http.sslCAInfo <temp cert>` when
private `git_source` registries were configured. That permanently modified
the user's global git configuration, and on non-ephemeral (e.g. self-hosted)
runners it kept pointing at a temporary certificate file after the job
finished, breaking later git HTTPS operations.

Instead, set `GIT_SSL_CAINFO` alongside `SSL_CERT_FILE` in the environment
that `ApplyProxyEnvVars` applies to `go` commands. This is picked up by the
`git` processes `go` spawns, and is scoped to those subprocesses.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Document the proxy certificate behavior without referring to the previous global Git configuration, and add a Go extractor change note.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>