release: Don't install FreeBSD-caroot in the notoolchain image

[dfr]

Summary

The certificates are already present since they were copied into the
static parent image.

If FreeBSD-caroot is installed, the post-install hook runs the host's
certctl to rehash. If the host is running FreeBSD-14, this results in
installing symbolic links. This is different from the FreeBSD-15 certctl
which copies the files and results in different image contents depending
on the build host.

MFC after: 1 day

[dch]

FreeBSD-caroot is in both minimal,minimal-jail package sets atm & that
seems (from a non-OCI jail perspective) to be the right thing to do.

If we are building these in re@ for release & snapshots, the build
hosts will always be newer. Does it matter for (a very small set of)
downstream users who build their own OCI containers from scratch,
that the image contents are slightly different?

i.e. if we don't land this, does anybody care other than us?

[dfr]

In D52616#1204489, @dch wrote:

i.e. if we don't land this, does anybody care other than us?

Its probably just me that cares about it to be honest. I came across the issue while diffing images built with the simpler layer-squashing script and the new layer preserving script. Releases are built in a chroot which matches the release so this problem only affects people like me who are taking shortcuts to reduce the iteration time while debugging.

[dfr]

This issue does not affect the release building process and will resolve itself for me when I update my build host to stable/15