#46159 crypto: update root certificates

What does this PR do?

Regenerates the bundled root certificates (root_certs.der / root_certs.txt) with generate-root-certs.pl. The script now takes a list of labels to leave out, next to its existing TrustCor rule. certdata.txt is unchanged.

The regenerated root_certs.der holds 117 certificates, matching root_certs.txt.

How did you verify your code works?

• Parsed the old and new root_certs.der: 121 → 117 entries, none added, the four above are the only ones gone, and the other 117 are byte-identical and in the same order.
• The tests that compare the embedded bundle with certdata.txt are updated, and a new one checks the four by SHA-256. All of them fail on Bun 1.4.4, which embeds the previous bundle. Their assertions hold when evaluated against the new root_certs.der.
• New generator fixture test: a listed label is left out and a look-alike label is kept. The previous script keeps both.
• Not run against a local build of this branch, so CI is the first run of the embedded-bundle tests.