🐛 fall back to system trust store when no custom TLS CA is set

[mathieuHa]

Closes #327.

Problem

Setting crowdsecLapiScheme=https against a LAPI exposed behind a reverse proxy with a publicly trusted certificate (e.g. Let's Encrypt) currently forces the operator to pick one of two suboptimal options:

• set crowdsecLapiTLSInsecureVerify=true (skip verification — defeats the point), or
• pin crowdsecLapiTLSCertificateAuthority to a CA bundle (extra config nobody should need for a public CA).

The expected behavior — "use the system trust store" — wasn't reachable.

Root cause

Two contributing bugs in pkg/configuration/configuration.go:

1. validateParamsTLS returned an error when CrowdsecLapiTLSCertificateAuthority was empty.
2. getTLSConfig always initialized tls.Config.RootCAs = x509.NewCertPool() (an empty pool), which silently disables the stdlib's fall-back to x509.SystemCertPool(). So even if validation didn't fire, verification of a Let's Encrypt cert would still fail.

The Go idiom for "use the system trust store" is to leave tls.Config.RootCAs as nil. The traefik image (alpine + ca-certificates) ships a CA bundle that already trusts the public roots.

Fix

• validateParamsTLS: drop the empty-CA error; still rejects garbage PEM.
• getTLSConfig: only allocate RootCAs when a custom CA is provided; otherwise leave it nil.
• Same change applies symmetrically to the AppSec path (helper is shared).

Tests

Test_validateParamsTLS and Test_GetTLSConfigCrowdsec were scaffolds (// TODO: Add test cases.) — now filled in.

Test_validateParamsTLS covers:

• Empty CA → accepted
• Valid PEM → accepted
• Garbage CA → rejected

Test_GetTLSConfigCrowdsec covers:

• HTTP scheme → empty tls.Config
• HTTPS + no CA → RootCAs == nil (system trust store)
• HTTPS + custom CA → RootCAs populated
• HTTPS + insecure verify → InsecureSkipVerify == true
• HTTPS + garbage CA → error

Docs

README.md — replaced the "you need to either accept any certificates or add the CA" wording with three explicit options (system trust store / custom CA / skip verification), for both the LAPI and the AppSec sections. Per-field descriptions of Crowdsec{Lapi,Appsec}TlsCertificateAuthority now mention the system trust store as the default fallback.

Compatibility

No behavior change for existing setups: configs that explicitly set a custom CA or insecure verify continue to work identically. The new behavior is only reachable by omitting both — which was rejected before.