Bootstrap CA certs before Ubuntu snapshot apt

ober

d9c81a27e48a799e067c7e155266a4b3e61848d0

diff --git a/Dockerfile.qt b/Dockerfile.qt
index d3372fa..fe3fc6c 100644
--- a/Dockerfile.qt
+++ b/Dockerfile.qt
@@ -15,7 +15,7 @@
 ARG BASE_IMAGE=docker.io/library/ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
 FROM ${BASE_IMAGE} AS builder
 
-ARG JERBOA_VERSION=v0.2.4
+ARG JERBOA_VERSION=v0.2.7
 ARG JBROWSER_SOURCE_COMMIT
 ARG JBROWSER_SOURCE_TREE
 ARG APT_SNAPSHOT=20260701T000000Z
@@ -23,13 +23,13 @@ ARG APT_SNAPSHOT=20260701T000000Z
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PATH=/root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
-RUN sed -Ei \
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && \
+    sed -Ei \
       -e "s#https?://(archive|security)\\.ubuntu\\.com/ubuntu/?#https://snapshot.ubuntu.com/ubuntu/${APT_SNAPSHOT}/#g" \
       -e "s#https?://ports\\.ubuntu\\.com/ubuntu-ports/?#https://snapshot.ubuntu.com/ubuntu/${APT_SNAPSHOT}/#g" \
       /etc/apt/sources.list.d/ubuntu.sources && \
     apt-get update && apt-get install -y --no-install-recommends \
     bash \
-    ca-certificates \
     cmake \
     curl \
     file \