Document how to rotate a `cacert` linked to a clouds.yaml:

• when first adding one (e.g. when OSP migrates its endpoints from HTTP to HTTPS)
• when the need arises to change the root certificate (ie when OSP migrates to HTTPS endpoints secured with a custom root cert, to HTTPS endpoints secured with another custom root cert)