Go: Clarify registry proxy certificate handling

Document the proxy certificate behavior without referring to the previous global Git configuration, and add a Go extractor change note.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jketema

go/extractor/registries/registryproxy.go

@@ -104,8 +104,7 @@ func getEnvVars() []string {
 		} else {
 			proxy_cert_file = f.Name()
 			// `SSL_CERT_FILE` is used by Go itself; `GIT_SSL_CAINFO` is used by the `git`
-			// processes that `go` spawns to fetch `git_source` modules. Setting it here scopes
-			// the certificate to our subprocesses instead of modifying the global git configuration.
+			// processes that `go` spawns to fetch `git_source` modules.
 			result = append(
 				result,
 				fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file),

go/old-change-notes/2026-10-26-go-registry-proxy-certificate.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The Go extractor now passes the registry proxy CA certificate to Git subprocesses, allowing private `git_source` modules to be fetched through the proxy.