citrix_receiver: document installation pitfalls and `extraCerts` (#44635)

Since #44522 it's possible to specify custom certificates for the Citrix
receiver. As it took me some time to create a proper setup Citrix can
behave fairly unexpected.

I mostly covered two aspects:

* Don't install Citrix with `nix run`: when `citrix.desktop` is linked
  to $XDG_CONFIG_DIRS, it's possible to start a session directly from the
  browser when loading `.ica` files which makes the usage *way* easier.

* It's possible to add custom certificates using the Citrix wrapper. A
  new store path with the original derivation and the certificates will be
  created and therefore no rebuild of the package is needed when adding
  new certs.