Allow Use of Public CAs

As a public cloud operator it strikes me as odd that I have to supply a
CA certificate for every cluster that's created.  This leads to a bunch
of code that has to Dial the endpoint and extract the root CA (rather
than hard coding it - ugh!).  The whole point of the distroless base
container image is to distribute TLS root CAs, so allow the option to
use what's already present.

pkg/scope/provider.go

@@ -153,13 +153,14 @@ func NewProviderClient(cloud clientconfig.Cloud, caCert []byte, logger logr.Logg
 	}
 
 	config := &tls.Config{
-		RootCAs:    x509.NewCertPool(),
 		MinVersion: tls.VersionTLS12,
 	}
 	if cloud.Verify != nil {
 		config.InsecureSkipVerify = !*cloud.Verify
 	}
+
 	if caCert != nil {
+		config.RootCAs = x509.NewCertPool()
 		config.RootCAs.AppendCertsFromPEM(caCert)
 	}