certs: fix self-signed cert guidance in CDH example config

[nogunix]

What this does

Corrects the self-signed certificate guidance in
confidential-data-hub/example.config.toml. The comment stated that a
self-signed certificate must have the basicConstraints CA:true extension,
but rustls (the default TLS backend) does the opposite: it rejects a
CA:true certificate when it is presented as a leaf (end-entity), failing
with a CaUsedAsEndEntity error.

Why

A self-signed certificate added via extra_root_certificates (or an
image_pull_proxy certificate) becomes both the trust anchor and the leaf
presented during the TLS handshake. webpki validates the leaf and rejects
CA:true in the end-entity position, so the current guidance leads users to
create certificates that fail the handshake.

Verification

Reproduced end-to-end with a tokio-rustls server + reqwest (rustls) client,
using the same cert as both trust anchor and leaf, on
rustls 0.23.42 / rustls-webpki 0.103.13 / reqwest 0.12.28:

• basicConstraints CA:true self-signed leaf → REJECTED (CaUsedAsEndEntity)
• basicConstraints CA:false self-signed leaf → ACCEPTED (HTTP 200)

Change

Fixes the extra_root_certificates and image_pull_proxy comment blocks to
state that a self-signed cert must not have CA:true, and to point at the
recommended alternative (a CA:true CA cert signing a separate CA:false
server cert).

[mythi]

@bpradipt PTAL? (ref a3eb154)