pki: add new vault root ca to pki

system/pki/root-ca.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+{
+  security.pki = {
+    certificateFiles = [
+      "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ./root-ca.crt
+      ./vault-root-ca.crt
+    ];
+  };
+}