Multiple fixes for z-push

• Use our own repo for z-push, with few new fixes:
  • Reject 401
  • z-push!1 (diffs)
• Pull over ssh instead of http, to allow to keep a private repo
• Install CERN CA in base image
• Update documentation