Self-hosted Kura cache nodes with per-account CA enrollment

Organizations can now deploy self-hosted Kura cache nodes on their own infrastructure and have them authorized by Tuist’s control plane. Each account gets its own certificate authority for mesh enrollment, so a self-hosted node joins the same mutually-authenticated mesh as managed nodes using just a credential and a URL. Nodes can run in a standalone mode where artifact bytes never leave the customer’s infrastructure, or in a bridged mode that pushes writes into the managed mesh for shared caching. This gives customers locality, data residency, and control over their own cache nodes without giving up Tuist-managed authentication and discovery.