[PATCH 1/2] ca-certificates: Sync with Mozilla's current trust store