update ca-certificates.crt and improvements to that

[smoser]

Currently the way to update src/etc/ssl/certs/ca-certificates.crt is (per a501728) :

• wget https://github.com/mozilla/gecko-dev/raw/master/security/nss/lib/ckfw/builtins/certdata.txt -O certdata.txt
• ./bin/mkcabundle <certdata.txt > src/etc/ssl/certs/ca-certificates.crt

We should do that now (last update was 2016) and also fix writing of the header to say where the cert came from. Currently it says Source: with no actual source. Would be nice to get a git-hash there.

[hrw]

This can and should be automated as well.

Simple workflow: https://github.com/ad-m/github-push-action

[smoser]

Updated in #41 .
We can leave this open to make it automatic.
Thanks.