Use CA certificate if provided

If a certificate authority certificate for the codesigning certificate is provided via SECRET_CODESIGNING_CACERT_FILE, then pass it to mkarchiso and embed it in the signatures for ipxe binaries.

This allows to use a common CA for releng building and could simplify key rotation of the persons (or CI) allowed to sign releng artifacts.