Windows 11 related WSL updates root ca docs

[ilnytskyi]

Summary

This PR documents two Windows / WSL improvements and caveats around local HTTPS and DNS resolution:

• warden install now imports the Warden root CA into the Windows CurrentUser\Root store when run inside WSL, so Windows browsers can trust Warden-issued certificates without a separate manual import step.
• Some newer Windows 11 setups can still fail DNS resolution because Hyper-V firewall behavior prevents Windows DNS traffic from reaching Warden's local dnsmasq service, even when 127.0.0.1 is configured as the primary DNS server.

Documentation changes

• Update the "Trusted CA Root Certificate" section in installing.md to describe the automatic Windows certificate import performed from WSL.
• Add screenshots showing successful trust in Firefox, Chrome, and Edge, plus the Windows 11 certificate confirmation dialog.
• Update the Windows installation section in installing.md to call out the exact Windows hosts file path and the Windows 11 / Hyper-V firewall caveat.
• Update configuration/dns-resolver.md with Windows fallback options:
  • manual entries in C:\Windows\System32\drivers\etc\hosts
  • launching Chrome with --host-resolver-rules
• Add matching UNRELEASED changelog entries.

Screenshots

• Browser validation screenshot: configuration/screenshots/windows-11-certs.png
• Windows certificate import dialog screenshot: configuration/screenshots/win-11-wsl-cert.png

Related code branch

Main repo branch for the implementation: codex/wsl-windows-root-ca