chore(docker): ca-certificates + h2o binary in benchmarks image

[avantgardnerio]

Summary

Additive Docker image changes for S3-backed EKS benchmark runs, plus wiring the
h2o binary (added in #2230) into the benchmarks image.

• ballista-scheduler + ballista-executor: install ca-certificates.
  Without them, DataFusion's object_store S3 client fails TLS verification with
  InvalidCertificate(UnknownIssuer), and STS AssumeRoleWithWebIdentity
  (IRSA-authenticated S3 reads on EKS) fails the same way. Ubuntu's minimal
  image doesn't populate /etc/ssl/certs.
• ballista-benchmarks: same ca-certificates rationale, plus
  COPY target/release/h2o /root/h2o so the image bundles both the tpch and
  h2o binaries. The h2o binary shipped in ci: add h2o window suite CI job #2230 but was never wired into the
  Dockerfile.
• .dockerignore: whitelist target/release{,-nonlto}/h2o so the
  benchmarks build context sees the h2o binary alongside tpch/etc. Missing
  whitelist entry means the COPY line above errors out during build.

TPC-H bench workflow is unaffected — every change is additive.

Test plan

• docker build -f dev/docker/ballista-scheduler.Dockerfile . succeeds
• docker build -f dev/docker/ballista-executor.Dockerfile . succeeds
• docker build -f dev/docker/ballista-benchmarks.Dockerfile . succeeds
• docker run --rm <benchmarks-image> ls /root/h2o prints the binary path
• docker run --rm <executor-image> ls /etc/ssl/certs | wc -l > 0
• EKS run: h2o Q1 reads from an s3://... path without TLS errors

[milenkovicm]

LGTM, thanks @avantgardnerio

[avantgardnerio]

LGTM, thanks @avantgardnerio

Damn, you're fast today 😄

[milenkovicm]

I want to be seen as helpful while avoiding other major PR changes that require deep engagement and focus. 😀
I finally got some time to spend on ballista, hope to help more, and im trying to catch up with all the changes i've missed

[avantgardnerio]

I want to be seen as helpful while avoiding other major PR changes that require deep engagement and focus. 😀 I finally got some time to spend on ballista, hope to help more, and im trying to catch up with all the changes i've missed

Well, this is the big one - it gets parallel windows working end-to-end with decent benchmark results.

So I'll just keep extracting smaller ones out of there, as long as you're willing to review, I can keep you busy 😄 . Not required, but very much appreciated!

[milenkovicm]

will have a look over the weekend hopefully