Docker: add ca-certificates to runtime
Current Alpine doesn't ship with the "well-known" CA
certificates. Without them present, outbound HTTPS or TLS connections
aren't even initiated, leading to this at startup:
```
fetching token failed: No SSL/TLS CA certificates found.
```
This adds `ca-certificates` to the runtime image.