[Backport 19.5] Distrust compromised eMudhra CA certificates

What does this MR do?

Removes trust in the compromised eMudhra CA certificates (https://emudhra.we-have-a-problem.com/) from the UBI and Debian images, at build time and when the certificates container runs.

• UBI: ca-certificates-2025.2.80_v9.0.305-91.el9 is the newest package in the UBI 9.8 repositories. It still trusts the anchor emSign ECC Root CA - G3, which accepts 6 of the 12 compromised test chains. The new hardening/003_ca_distrust.sh puts hardening/ca-distrust/*.pem in the p11-kit blocklist and extracts the trust store again. All UBI Dockerfiles run the hardening scripts, so this also covers kubectl, gitlab-kas, gitlab-agentk, gitlab-zoekt and cfssl-self-sign. These images build on ubi-micro and install their own ca-certificates. At runtime, update-ca-trust extract in bundle-certificates-ubi applies the blocklist, also to custom CAs that users mount.
• Debian: 20250419+deb13u1 already drops these roots. But update-ca-certificates adds every certificate in /usr/local/share/ca-certificates, so a custom CA mount can bring them back. The new /scripts/ca-distrust removes the certificates that match a fingerprint in the list, from the files, hash links and bundles in /etc/ssl/certs. It runs in gitlab-base at build time and at the end of bundle-certificates.

The list holds 21 certificates: 4 roots, the emSign Root TLS CA - G3 cross-sign, and the 16 compromised intermediates. Each one has its SHA-256 fingerprint in a comment. The roots must be in the list: a blocklist with only the intermediates still trusts 6/12 chains in the PEM bundles that Go, curl and Ruby read.

The advisory's Linux workarounds block 2 roots by label, and the Debian ! lines only apply to package certificates. Neither one blocks a CA that a user mounts. With them, a mounted emSign Root TLS CA - G3 (UBI) or mounted roots (Debian) are still trusted.

Distrusting emSign ECC Root CA - G3 also distrusts legitimate sites under that root, the same as the advisory and the Debian fix.

Backport of !3189 (merged) to 19-5-stable. The five commits from !3189 (merged) are cherry-picked with -x and applied without conflicts. The diff against 19-5-stable is identical to the !3189 (merged) diff.

Related issues

Related to #2467

Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

• Merge Request Title, and Description are up to date, accurate, and descriptive
• MR targeting the appropriate branch
• MR has a green pipeline on GitLab.com
• When ready for review, MR is labeled "~workflow::ready for review" per the Distribution MR workflow

Expected (please provide an explanation if not completing)

• Test plan indicating conditions for success has been posted and passes
• Documentation created/updated
• Integration tests added to GitLab QA
• The impact any change in container size has should be evaluated
• New dependencies are managed with GitLab forked renovatebot

🤖 Generated with Claude Code