Go: Clarify registry proxy certificate handling

Document the proxy certificate behavior without referring to the previous global Git configuration, and add a change note.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jketema

go/extractor/registries/registryproxy.go

@@ -104,8 +104,7 @@ func getEnvVars() []string {
 		} else {
 			proxy_cert_file = f.Name()
 			// `SSL_CERT_FILE` is used by Go itself; `GIT_SSL_CAINFO` is used by the `git`
-			// processes that `go` spawns to fetch `git_source` modules. Setting it here scopes
-			// the certificate to our subprocesses instead of modifying the global git configuration.
+			// processes that `go` spawns to fetch `git_source` modules.
 			result = append(
 				result,
 				fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file),

go/ql/lib/change-notes/2026-10-26-registry-proxy-certificate.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* The Go extractor no longer modifies the global Git configuration when private `git_source` registries are configured. The registry proxy certificate is now passed to Git through the `GIT_SSL_CAINFO` environment variable instead, which only affects the Git processes spawned by `go`.