option to not inject root CAs in case they're already in the image #294