#46300 tls: reject chains containing blocked public keys, update root certificates to NSS 3.131.1

What does this PR do?

A certificate chain that holds a public key on a compiled-in list now fails verification with CERT_REVOKED. This is a port of Node's check and uses Node's list.

Updates certdata.txt to NSS 3.131.1 and regenerates the bundled root certificates (root_certs.der / root_certs.txt). generate-root-certs.pl no longer takes a list of labels to leave out.

The regenerated root_certs.der holds 118 certificates, matching root_certs.txt.

How did you verify your code works?

• The list and certdata.txt are identical to Node's, and the 118 certificates are the same set as Node's, compared by SHA-256.
• The test that compares the embedded bundle with certdata.txt fails on Bun 1.4.3, which embeds the previous bundle.
• New tests cover node:tls clients and servers, fetch, the HTTP/3 client and node:quic.
• Not run against a local build of this branch, so CI is the first run of the new code and tests.