CA.md: clarify two-CA model and add per-flag explanations

[sourcequench]

Summary

• Use separate CA keypairs for host and user certificate signing so it is explicit that different private keys sign each certificate type. Adds a table showing which public key gets distributed where (TrustedUserCAKeys vs known_hosts).
• Add a hiba-ca.sh flag reference table covering all action, type, and parameter flags.
• Annotate every step with per-flag bullet explanations. The sign steps explicitly call out which CA directory (and therefore which private key) is used and why it differs between host and user certificates.

Test plan

• All ten steps in the updated Example CA Usage run successfully end-to-end
• ssh-keygen -lf ~/.hiba-ca-host/ca.pub and ssh-keygen -lf ~/.hiba-ca-user/ca.pub show distinct fingerprints confirming separate signing keys
• ssh-keygen -Lf ~/.hiba-ca-host/hosts/<host>-cert.pub shows the host CA fingerprint; the user cert shows the user CA fingerprint

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.