feat: Add opt-in support for proxy CA cert installation (#318)

* feat: Add opt-in support for proxy CA cert installation

* fix: Code review fixes

* fix: Code review fixes

* fix: Code review fixes

* fix: Code review fixes

* fix: Code review fixes

* docs: Add limitation for MacOS MDM script

truststore/truststore_certfile.go

@@ -0,0 +1,35 @@
+//go:build darwin || linux || windows
+// +build darwin linux windows
+
+package truststore
+
+import (
+	"fmt"
+	"os"
+)
+
+// writeTempCert writes certPEM to a temp file and returns its path and a cleanup
+// func. The OS trust tools (macOS security, Windows certutil, Linux install)
+// take a file path argument, so the cert is staged in a user-owned temp file
+// before the elevated store write.
+func writeTempCert(certPEM []byte) (string, func(), error) {
+	noop := func() {}
+
+	f, err := os.CreateTemp("", "pmg-ca-*.pem")
+	if err != nil {
+		return "", noop, fmt.Errorf("failed to create temp cert file: %w", err)
+	}
+
+	if _, err := f.Write(certPEM); err != nil {
+		_ = f.Close()
+		_ = os.Remove(f.Name())
+		return "", noop, fmt.Errorf("failed to write temp cert file: %w", err)
+	}
+
+	if err := f.Close(); err != nil {
+		_ = os.Remove(f.Name())
+		return "", noop, fmt.Errorf("failed to close temp cert file: %w", err)
+	}
+
+	return f.Name(), func() { _ = os.Remove(f.Name()) }, nil
+}