ci(stepup-behat): generate HAProxy dev certificate before compose up

[kayjoosten]

Problem

stepup-behat CI (and Stepup-Gateway's test-integration, which brings the
stack up the same way) fails: the haproxy container never starts —

error mounting ".../core/haproxy/haproxy.pem" ... not a directory:
Are you trying to mount a directory onto a file (or vice-versa)?

With no TLS front end, every Behat scenario fails; the headless-Chrome
functional scenarios surface it as WebSocket\TimeoutException: Empty read; connection dead? because the browser can't load any
https://*.dev.openconext.local page.

Cause

Commit 2291d6f (2026-08-12) stopped committing core/haproxy/haproxy.pem
and moved its generation into core/scripts/create_dev_ca.sh, which is only
invoked by start-dev-env.sh. CI runs docker compose up directly, so the
file is missing and Docker auto-creates it as an empty directory.

Fix

Run create_dev_ca.sh in the Init step before compose up, guarded the same
way start-dev-env.sh guards it.

Verified locally against the Stepup-Gateway functional Behat suite (devconf
main + this change): 25 scenarios / 310 steps all pass; without it, 25/25 fail.

Supersedes #97 (which chased a wrong --remote-allow-origins lead).

[kayjoosten]

CI on this branch now gets 155 Behat scenarios running (53 passing) where main gets 0 — the haproxy container starts and the stack comes up. The remaining 102 failures (selectOption() on null, gateway_verify_yubikey_yubikeyInput not found) are a separate pre-existing breakage in the full SelfService/RA behat suite on main (red since ~2026-08-12) and are out of scope for this cert fix. Verified separately: with this change the Stepup-Gateway @functional suite is fully green (25/25).