Provide an ibmcloud oc CLI command (and Terraform resource parameter) to configure a custom trusted CA bundle on ROKS Hosted Control Plane clusters

ROKS clusters using the Hosted Control Plane (HyperShift) architecture manage the cluster proxy configuration through the HostedCluster object on IBM's management plane. The Proxy CR on the data plane is read-only — a ValidatingAdmissionPolicy blocks all modifications:proxies.config.openshift.io "cluster" is forbidden: ValidatingAdmissionPolicy 'config' with binding 'config-binding' denied request: This resource cannot be created, updated, or deleted. Please ask your administrator to modify the resource in the HostedCluster object. This means customers cannot configure a custom trusted CA bundle on ROKS HCP clusters without opening a support case and waiting for IBM to manually modify the HostedCluster object.On ROSA clusters, this is a routine day-2 operation that takes seconds. On ROKS HCP, it requires a support case with multi-day turnaround, blocking cluster provisioning and production readiness. The trusted CA bundle is a foundational configuration — nearly every enterprise deployment needs it. The inability to set it self-service makes ROKS HCP impractical for enterprise workloads that access internal PKI-protected services.