ca-certificates: - update to 2026.03.19 - install to /etc/cacert - extract individual ceritificates from the bundle openssl: - depend on ca-certificates - install hashed symlinks to individual certs curl: - don't depend on ca-certificates; openssl handles this - set both ca-bundle and ca-path