fix(ssl): create certificate output directory

[floze-the-genius]

What does this do?

Closes #257.

A fresh clone does not contain docker/ssl/certs, so both direct CA generation and the root check-certs prerequisite fail when OpenSSL tries to write certs/ca.key.

This adds an idempotent $(CRT_LOCATION) directory target and makes ca depend on it as an order-only prerequisite. Existing certificate directories are left untouched, and the directory timestamp does not force CA regeneration.

Verification

• Reproduced make -C docker/ssl ca failing with Can't open "certs/ca.key" for writing before the change.
• Reproduced root make check-certs failing for the same reason before the change.
• Verified direct CA generation succeeds with a missing nested CRT_LOCATION and creates the directory, ca.crt, and ca.key.
• Verified root make check-certs creates CA and server certificates successfully.
• Verified a second root run performs zero OpenSSL invocations and preserves certificate hashes.
• Verified an existing destination does not run a redundant mkdir recipe.
• go test ./...
• git diff --check

Disposable certificates were generated only under /tmp; repository and user certificate paths were not modified.