ci(gruppenpruefung): trust the lab CA for the git.lab API call

The job got past the git fix but then failed the urllib call to https://git.lab
with CERTIFICATE_VERIFY_FAILED: gruppenpruefung.py uses urllib's default trust,
which in python:3.12-alpine does not include the private aXionLabs CA. Point
SSL_CERT_FILE at the repo's ci/lab-ca-chain.crt (the same chain curl --cacert
uses); Python honours it in the default SSL context. Verified locally: the
context loads the 2 lab CA certs.

.gitlab-ci.yml

@@ -62,6 +62,10 @@ gruppenpruefung:
   rules:
     - if: $CI_PIPELINE_SOURCE == "schedule"
     - if: $CI_PIPELINE_SOURCE == "web"
+  variables:
+    # gruppenpruefung.py spricht die git.lab-API per urllib an; git.lab läuft
+    # über die private aXionLabs-CA. Python honoriert SSL_CERT_FILE im Default-Context.
+    SSL_CERT_FILE: "$CI_PROJECT_DIR/ci/lab-ca-chain.crt"
   before_script:
     - apk add --no-cache git >/dev/null   # gruppenpruefung.py ruft 'git log' auf
   script: