Add opt-in PORTAINER_INSECURE flag to skip TLS verification

[nopoz]

Summary

Portainer behind a self-signed or private certificate fails every API call with curl exit 60 and no recovery path, since validate_url accepts https:// but no curl call could skip verification. This adds an opt-in PORTAINER_INSECURE flag (true/1/yes) that skips TLS verification; verification stays on by default.

Mirrors the same treatment applied to hosaka in nopoz/hosaka#95.

Changes

• load_config: builds an INSECURE_CURL array, set to (--insecure) only on a truthy value. A boolean self-validates to the secure default, so there is no reject/warn branch (unlike PORTAINER_BACKUP_UMASK, whose validation guards a real YAML octal footgun).
• make_api_request and both cmd_test curls splat "${INSECURE_CURL[@]}", covering every Portainer call.
• cmd_test preflight captures the curl exit code; 60 (cert verification failed) yields a TLS-specific error naming PORTAINER_INSECURE instead of a generic unreachable-host message.
• Docs: README env table, docker-compose.yml commented line, .portainer_config.sample commented line.

Testing

• shellcheck portrieve.sh docker-entrypoint.sh clean; bash -n ok.
• Flag parse verified: true/1/yes -> --insecure; false/junk/unset -> empty.
• Empty-array splat is safe under set -euo pipefail.
• Not exercised against a live self-signed Portainer instance.