fix: expose PostgreSQL SSL options in Docker Compose

[Shriprasad-P]

Description of the Change

Fixes #421.

run_goose.py and the metadata service already support PostgreSQL SSL
configuration, but docker-compose.yml did not forward those environment
variables into the metadata container.

This change exposes the existing SSL settings through Compose while preserving
the current non-SSL behavior.

Supported configuration includes:

• MF_METADATA_DB_SSL_MODE
• MF_METADATA_DB_SSL_CERT_PATH
• MF_METADATA_DB_SSL_KEY_PATH
• PostgreSQL root certificate path configuration

run_goose.py also accepts the root-certificate variable used by the metadata
service so migrations and the service can use the same mounted certificate
configuration.

Custom certificate files are not bundled into the image or repository. Users
continue to mount their own certificate files and provide container paths.

This PR does not change the existing Compose database host/user/password/name
defaults. Deployments using an external PostgreSQL/RDS endpoint can continue to
override those separately.

Backward Compatibility

When SSL variables are unset or empty:

• effective behavior remains sslmode=disable
• empty certificate query parameters are not emitted
• existing local Compose database behavior is unchanged

MF_METADATA_DB_SSL_MODE is intentionally passed through rather than defaulted
to prefer, so existing deployments do not change behavior.

Verification

• Unit tests covering DB configuration and Goose SSL DSN construction
• docker compose -f docker-compose.yml config with SSL variables unset
• Compose config validation with sslmode=prefer and mounted certificate paths
• Python formatting checks
• git diff --check

No live AWS RDS environment was used for validation.

AI Tool Usage

AI tools were used to assist with repository inspection, implementation review,
and test planning. I reviewed and tested the final changes and take
responsibility for the submitted code.