Issue with CA certs in 1.18.0

We're also hitting this in production after upgrading from 1.16.0 to 1.18.0. The fix in #10957 (v1.17.0) does not resolve it for us. Our setup:

const httpsAgent = new https.Agent({ ca: [fs.readFileSync('/path/to/corp-ca.pem')] });
axios.get('https://internal-api.example.com/data', {
   httpsAgent, 
   proxy: { protocol: 'http', host: 'proxy.corp.net', port: 3128 }, 
});

• 1.16.0: works — ca is applied to the TLS connection to the origin
• 1.17.0 / 1.18.0: fails with UNABLE_TO_GET_ISSUER_CERT_LOCALLY — the custom ca from the httpsAgent is dropped during the CONNECT tunnel to the origin

The ca certificates are trusted by the origin server (not the proxy). The proxy is plain HTTP. We've confirmed the cert file is present and valid — it's the tunneling that loses the TLS options. We've had to pin back to 1.16.0 as a workaround.

Originally posted by @crewhakiim in #10953