Keep the system CA store when callers set NODE_OPTIONS

The entrypoint now prepends --use-openssl-ca to a caller-supplied NODE_OPTIONS
(e.g. a heap limit) instead of letting it replace the image default, unless the
caller already picked a CA store. Also trims the 2.11.2 changelog entry to what
users will notice.

Author: lelia

scripts/docker-entrypoint.sh

@@ -7,6 +7,14 @@
 # Set GOROOT from the value determined at build time
 export GOROOT=$(cat /etc/goroot)
 
+# Keep Node on the system CA store (see NODE_OPTIONS in the Dockerfile) when the
+# caller sets their own NODE_OPTIONS, e.g. a heap limit. Leave an explicit CA
+# store choice alone, since Node rejects conflicting CA flags.
+case " ${NODE_OPTIONS:-} " in
+    *" --use-openssl-ca "*|*" --use-bundled-ca "*|*" --use-system-ca "*) ;;
+    *) export NODE_OPTIONS="--use-openssl-ca${NODE_OPTIONS:+ $NODE_OPTIONS}" ;;
+esac
+
 # Check if we have any arguments
 if [ $# -eq 0 ]; then
     # No arguments provided, run socketcli with no args (will show help)