actual-budget: use a CA bundle without the compromised eMudhra roots

Node uses its built-in roots, which still include emSign ECC Root CA - G3,
and the Node fix is still pending. Switch to OpenSSL's store with
--use-openssl-ca and point it at patched-ca-bundle, mounted over
/etc/ssl/certs. That covers bank sync and the authentik OIDC calls.

actual-budget/helm-actual-budget.yaml

@@ -36,6 +36,20 @@ spec:
 
         extraEnvVars:
           ACTUAL_OPENID_SERVER_HOSTNAME: https://ynab.rubenhensen.nl
+          # Node trusts its built-in roots, which still include the ones
+          # above the compromised eMudhra intermediates. Use patched-ca-bundle
+          # through OpenSSL instead until Node ships a fix.
+          NODE_OPTIONS: --use-openssl-ca
+          SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
+
+        volumes:
+          - name: patched-ca-bundle
+            configMap:
+              name: patched-ca-bundle
+        volumeMounts:
+          - name: patched-ca-bundle
+            mountPath: /etc/ssl/certs
+            readOnly: true
 
         # Service configuration
         service: