Bundle Certificate Authorities

[aaronmondal]

At the moment it's still necessary to have an OS-specific CA installed. Apart from making https resolution less reproducible this complicates packaging and increases container size. Adding external CAs should be an explicit config option.