add OpenBSD TA constraints and localhost TLS examples

docker/compose.localhost.yaml

@@ -0,0 +1,24 @@
+# Host-side test repository workflow.
+# Start tests/support/serve_repository.py on the host, then run this validator
+# with FIXTURE_DIR pointing at the generated fixture and network_mode=host.
+services:
+  validator:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:local}"
+    network_mode: host
+    user: "${PUID:-1000}:${PGID:-1000}"
+    read_only: true
+    init: true
+    tmpfs:
+      - /tmp
+    volumes:
+      - ${CONFIG_FILE:?set CONFIG_FILE to validate-localhost.toml}:/config/validate.toml:ro
+      - ${FIXTURE_DIR:?set FIXTURE_DIR to the generated test fixture}:/fixture:ro
+      - ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
+      - ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
+    command:
+      - validate
+      - --config
+      - /config/validate.toml