fix: panic in osroot controller

Fixes siderolabs#8753

There seems to be a problem in the machine config anyways, as
`machine.ca.crt` is missing for the worker (this should break `apid`
connectivity), but still Talos controller shouldn't enter a panic loop.

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>

internal/app/machined/pkg/controllers/secrets/root.go

@@ -165,11 +165,11 @@ func NewRootOSController() *RootOSController {
 					osSecrets.AcceptedCAs = append(osSecrets.AcceptedCAs, &x509.PEMEncodedCertificate{
 						Crt: osSecrets.IssuingCA.Crt,
 					})
-				}
 
-				if len(osSecrets.IssuingCA.Key) == 0 {
-					// drop incomplete issuing CA, as the machine config for workers contains just the cert
-					osSecrets.IssuingCA = nil
+					if len(osSecrets.IssuingCA.Key) == 0 {
+						// drop incomplete issuing CA, as the machine config for workers contains just the cert
+						osSecrets.IssuingCA = nil
+					}
 				}
 
 				osSecrets.CertSANIPs = nil