Replace certificates if failed to extract?

[the-real-jeremy-coleman]

Per the title. I think that when unable to extract certificates from the source image it makes more sense to throw an alert and fallback to "replace" functionality. The current failure feels unintuitive if someone is modifying an image where they haven't investigated what certificates may be embedded. I'm happy to make the changes and submit a PR but wanted to open the discussion first.

Current Flow:

1. Run incert to add certificates to an image with no certs (e.g. wolfi-base)
   incert -ca-certs-file ./corporate_forward_trust.crt -image-url cgr.dev/chainguard/grype:latest -dest-image-url localhost/grype:corp-certs
2. Incert fails
   Failed to extract CA certificates from image: failed to find /etc/ssl/certs/ca-certificates.crt in remote image
3. Think through error message and realize that your source must not have any certs.
4. Run incert without args, check the README, or whatever.
5. Notice the -replace-certs option.
6. Wonder why you have to replace something that doesn't exist.
7. Try it anyway.
8. Congratulate yourself for guessing correctly.

Desired Flow:

1. Run incert to add certificates to an image with no certs (e.g. wolfi-base)
   incert -ca-certs-file ./corporate_forward_trust.crt -image-url cgr.dev/chainguard/grype:latest -dest-image-url localhost/grype:corp-certs
2. Incert doesn't find source certificates, but falls back to "replace" functionality
3. You get a useful warning:
   Warning: Failed to extract CA certificates from image: failed to find /etc/ssl/certs/ca-certificates.crt in remote image. Generating new CA certificates file.
If you believe this is a mistake re-run with -image-cert-path set to the correct location.
4. Rejoice in success or go back to figure out where the CA certs are loaded in your source image.

Alternative Desired Flow:

1. Run incert to add certificates to an image with no certs (e.g. wolfi-base)
   incert -ca-certs-file ./corporate_forward_trust.crt -image-url cgr.dev/chainguard/grype:latest -dest-image-url localhost/grype:corp-certs
2. Incert doesn't find source certificates and fails with a more useful message.
   Failed to extract CA certificates from image: failed to find /etc/ssl/certs/ca-certificates.crt in remote image. Run with -replace-certs to generate a new CA certificates file.
3. Re-run incert with the recommended flag.
4. Raise your fists in success and thank the incert team for including a more useful message.