fix: embed CA certificates for environments without system certs

[TimPietruskyRunPod]

Summary

• Import golang.org/x/crypto/x509roots/fallback to embed Mozilla's CA certificate bundle in the binary
• This allows runpodctl to make HTTPS calls in environments without ca-certificates installed (e.g. minimal Docker images like ubuntu:22.04)
• When system certs are available, they are used as normal — the embedded bundle is only a fallback
• Binary size increase: ~200KB

The problem

Running runpodctl from inside a container based on a minimal image (without ca-certificates) fails:

Error: Post "https://api.runpod.io/graphql": tls: failed to verify certificate: x509: certificate signed by unknown authority

Verified

Tested on a live Runpod pod:

1. Removed ca-certificates from a running pod to simulate bare ubuntu:22.04
2. Old binary → x509: certificate signed by unknown authority
3. New binary (with embedded certs) → TLS succeeds, gets 401 (expected with fake API key)

Fixes #149