Document how to add `cacert` to the OpenStack credentials secret

[eromanova]

Currently, there is no documented instruction (or example) for adding a self-signed CA certificate to the OpenStack identityRef credentials secret. Without this, CCM cannot validate the OpenStack API endpoint's TLS certificate, and users have no clear reference for how to resolve it.