fix: never print passwords in bootstrap conflict errors; unpin ca-cer…

[LeeroyHannigan]

What

Two container-launch hygiene fixes, no behavior change on any success path. First, bootstrap password-conflict errors no longer print secrets: check_conflict formats both the CLI and config values into its error message, and at the --extenddb-pass call site in the Postgres bootstrapper that printed BOTH passwords in plaintext to stderr on a mismatch. Added check_conflict_redacted (names the flag, never the values) and switched the password call site to it; host, port, and username call sites deliberately keep the verbose variant since those values aid diagnosis and are not secrets. Second, the Dockerfile no longer pins ca-certificates to an exact Debian package version.

Why

In a container, stderr is the log stream and commonly shipped to aggregators, so a config drift on the app password would hand live credentials to anyone with log read access. That must not ship in a public image. The ca-certificates=20230311+deb12u1 pin is a build-reliability time bomb: Debian removes old package versions from its mirrors on rotation (current is 20250419~deb12u1), so the image build breaks the day that happens, possibly mid-release. Unpinning is safe: the runtime base is already pinned by digest, so apt resolves the version consistent with that digest, and nothing in the binary reads the system trust store (rustls throughout). Both were flagged during the container release preparation; landing them before the release tag is cut avoids shipping either in the first public image.

Closes # (no standing issue; pre-release hardening from the container release review)

Testing done

• New regression tests: test_check_conflict_redacted_never_leaks_either_value asserts the error names the flag and contains neither secret; test_check_conflict_redacted_ok_paths covers the match and no-CLI-arg cases.
• cargo test --workspace --locked: exit 0, 771 passed / 0 failed across 25 suites, 0 filtered out.
• cargo fmt --all -- --check: exit 0.
• cargo clippy on both touched crates (extenddb-storage, extenddb-storage-postgres), all targets: clean.
• Verified the mongo and sqlite bootstrappers have no other secret-bearing check_conflict call sites.

Checklist

• I have read CONTRIBUTING.md
• All tests pass (cargo test --workspace)
• Code is formatted (cargo fmt --check)
• Clippy is clean (cargo clippy -- -W clippy::pedantic)
• I have added or updated tests for new functionality
• I have updated documentation if behavior changed
• Breaking changes are noted below (if any)
• If this changes the wire protocol, Storage trait, auth model, on-disk
  format, or public CLI surface, an RFC has been accepted or is linked
  below. Otherwise, an ADR captures the decision (link below).

ADR / RFC: n/a (error-message hygiene and a Dockerfile package pin; no contract surface touched. The only observable change is that the password-mismatch error no longer echoes the values.)

---

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache License 2.0 and I agree to the Developer Certificate of
Origin (DCO). See CONTRIBUTING.md for details.