Add root CA driver

What does this MR do and why?

Adds the root CA driver abstraction for local SLSA attestation signing.

It generates root and leaf certificates with ECDSA P-256 and SHA-256, and delegates CA storage and signing to provider-specific implementations.

This is part of a 2 part MR

• Part 1 - RootCaDriver (You are here)
• Part 2 - PostgresCaDriver

References

• Part of https://gitlab.com/gitlab-org/gitlab/-/work_items/603912
• https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/slsa_level_3/decisions/007_attestations_private_dedicated_self_hosted/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/603908

Screenshots or screen recordings

Not applicable.

How to set up and validate locally

bin/rspec spec/lib/supply_chain/root_ca_driver_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.