Add CA bundle to scratch image; support tag suffix for rebuilds

- Grafana (GF_SERVER_ENFORCE_DOMAIN=true) 301-redirects API calls to the
  canonical https:// domain; Go TLS verification of the redirected request
  needs a CA bundle, which scratch lacks. Copy ca-certificates.crt into
  the final image.
- workflow_dispatch gains a 'suffix' input so the same upstream version
  can be rebuilt under a new tag (v1.1.0-1) without mutating v1.1.0.

.gitea/workflows/build.yaml

@@ -23,6 +23,10 @@ on:
         description: 'grafana/mcp-grafana GitHub release (empty = latest)'
         required: false
         default: ''
+      suffix:
+        description: 'Image tag suffix for rebuilds of the same upstream version (e.g. -1)'
+        required: false
+        default: ''
 
 env:
   REGISTRY: gitea.williammiceli.systems
@@ -54,7 +58,9 @@ jobs:
           echo "version=$VER" >> "$GITHUB_OUTPUT"
           # Image tag strips a leading 'v' from the release tag (v1.2.3 -> v1.2.3),
           # so the tag is always v<semver> regardless of upstream's tag style.
-          echo "tag=${VER#v}" >> "$GITHUB_OUTPUT"
+          # An optional workflow_dispatch suffix (-1) allows rebuilds of the same
+          # upstream version (e.g. image fixes) without overwriting the original tag.
+          echo "tag=${VER#v}${{ github.event.inputs.suffix }}" >> "$GITHUB_OUTPUT"
           echo "Resolved grafana/mcp-grafana version: $VER"
 
       - name: Skip if already published