Support configuring custom CA certificates

[ThomasVitale]

Description

• Introduce .withCaFile() and .withCaContent() method to Registry and HttpClient to provide custom CA certificates to be used for establishing a TLS connection with an OCI registry.
• Refactor HttpClient.Builder to ensure correct and consistent state when using multiple TLS-related methods like .withSkipTlsVerify(), .withCaFile(), and .withCaContent().
• Add integration tests for TLS-related operations with a Zot OCI registry. Introduce a ZotBaseContainer class to consolidate common logic rather than duplicating code in the newly added ZotTlsContainer for TLS-related tests.

Fixes gh-670

Testing done

• Added unit tests covering the new feature.
• Added integration tests covering the new feature.

Submitter checklist

• I have read and understood the CONTRIBUTING guide
• I have run mvn license:update-file-header, mvn spotless:apply, pre-commit run -a, mvn clean install before opening the PR

[codecov]

Codecov Report

❌ Patch coverage is 95.77465% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.62%. Comparing base (f230da5) to head (01d8caf).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/main/java/land/oras/auth/HttpClient.java	96.55%	2 Missing ⚠️
src/main/java/land/oras/Registry.java	92.30%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #687      +/-   ##
============================================
+ Coverage     86.70%   87.62%   +0.92%     
- Complexity      943      962      +19     
============================================
  Files            43       43              
  Lines          2910     2974      +64     
  Branches        364      371       +7     
============================================
+ Hits           2523     2606      +83     
+ Misses          229      210      -19     
  Partials        158      158              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jonesbusy]

Thanks for your PR. Looks very good so far.

I've added copilot review so see if it spots anything

[Copilot]

Pull request overview

Adds support for configuring custom CA certificates for TLS connections to OCI registries, and introduces test infrastructure + integration tests to validate TLS behaviors against a Zot registry.

Changes:

• Add withCaFile() / withCaContent() to HttpClient.Builder and Registry.Builder, and refactor TLS configuration to be applied consistently at build time.
• Introduce shared Zot Testcontainers utilities (ZotBaseContainer, TestImages) and a TLS-enabled Zot container (ZotTlsContainer).
• Add unit tests for TLS configuration validation and integration tests covering CA file/content and skip-verify behavior.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/main/java/land/oras/auth/HttpClient.java	Implements CA file/content handling and refactors TLS configuration logic in the client builder.
src/main/java/land/oras/Registry.java	Plumbs CA configuration through Registry.Builder into the internal HttpClient.
src/test/java/land/oras/auth/HttpClientTest.java	Adds unit tests for CA file/content validation and option incompatibilities.
src/test/java/land/oras/RegistryTlsTest.java	Adds integration coverage for connecting to a TLS-enabled Zot registry using CA file/content and skip-verify.
src/test/java/land/oras/utils/ZotBaseContainer.java	New shared base for Zot containers (image/port/config copy helpers, logging, registry address).
src/test/java/land/oras/utils/ZotContainer.java	Refactors existing auth-enabled Zot container to use ZotBaseContainer.
src/test/java/land/oras/utils/ZotUnsecureContainer.java	Refactors unsecure Zot container to use ZotBaseContainer and shared config-writing.
src/test/java/land/oras/utils/ZotTlsContainer.java	New TLS-enabled Zot container that generates/copies certs and exposes CA to tests.
src/test/java/land/oras/utils/TlsUtils.java	New test utility for generating certificates/keys (BouncyCastle-backed).
src/test/java/land/oras/utils/TestImages.java	Centralizes container image references used in tests.
pom.xml	Adds test dependency on bcpkix-jdk18on (and manages its version).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ThomasVitale]

I've just noticed the zot.yaml file that needs updating after the refactoring of the Zot container test classes. I'm fixing it now.

[ThomasVitale]

Updated zot.yaml now.