Introduce `kas-ca-cert-file` flag for agentk

Agentk should provide a new kas-ca-cert-file command line option that will eventually replace the existing ca-cert-file option in %17.0.