heroku data:pg:get-ca retrieves a Postgres CA bundle
For an Essential or Advanced Postgres database, retrieve the CA bundle for its Heroku region. Use that bundle and `sslmode=verify-full` in the client connection URL.
heroku data:pg:get-ca --region us