Multiple fixes for z-push

• Use our own repo for z-push, with few new fixes:
  • Reject 401
  • z-push!1 (diffs)
• Pull over ssh instead of http, to allow to keep a private repo
• Install CERN CA in base image
• Update documentation

Z-Push

-Subproject commit 0b23e961ac9f9dd052537f701c4eb4bf80584977
+Subproject commit 4b94fc926c520ac1db1376859928ba18b404733a