fix(ssl): create certificate output directory

[floze-the-genius]

What type of PR is this?

Bug fix.

What does this do?

Closes #257.

A fresh clone does not contain docker/ssl/certs, so certificate targets fail when their first writer tries to create a file under $(CRT_LOCATION).

This adds one idempotent $(CRT_LOCATION) directory target and makes every currently implemented certificate-producing target (ca, server_cert, and client_cert) use it as an order-only prerequisite. Existing directories are left untouched, and directory timestamps do not regenerate certificates.

The patch is rebased onto current main and includes a focused Makefile integration test. Certificate-generation settings and the existing CA dependency of server/client certificates are unchanged.

Verification

• Observed the new integration test fail on current main because no certificate target scheduled or created CRT_LOCATION.
• go test ./docker/ssl -run '^TestMakefile' -count=1 -v
• PROPELLER_REAL_OPENSSL_TEST=1 go test ./docker/ssl -run '^TestMakefileRealOpenSSLCheckCerts$' -count=1 -v
  • generates a real CA and server certificate in t.TempDir();
  • verifies the server certificate against that CA;
  • verifies a second root check-certs run preserves all four output files.
• go test -race ./docker/ssl -run '^TestMakefile' -count=1
• go test ./... -count=1
• go vet ./...
• golangci-lint v2.12.2 run --config ./.golangci.yaml — 0 issues
• git diff --check

Documentation is unchanged because this restores the existing documented setup behavior.

[rodneyosodo]

@floze-the-genius rebase and implement this for all certs

[floze-the-genius]

@rodneyosodo Rebased onto current main and applied the order-only CRT_LOCATION prerequisite to all three current certificate-producing targets: ca, server_cert, and client_cert. I also added focused Makefile integration coverage and verified the root flow with real OpenSSL; the exact commands are in the updated description. Ready for another look.