Add ability to pass a list/tuple of paths for generating CA bundle

### Context:- 

Today, when we specify the custom CA bundle via the below approach, there is no way to define a "collection of bundles" to load. I've a requirement of collection of bundles because I would like to create a client that is capable of handling HTTPS requests to multiple environments, think accessing a public/internal_custom_ca endpoint from the same object, example, a session object.

```
import requests
requests.get("https://www.google.com", verify="/path/to/bundle")
```

Exploring the [code](https://sourcegraph.com/github.com/psf/requests/-/blob/requests/adapters.py?L269), based on what `verify` is set by user, we set the attributes of class `urllib3.connectionpool.HTTPSConnectionPool` in `adapter code`.

As `urllib3` is used under-the-hood, we can make a case to add support for sending the `urllib3.connection.HTTPSConnection's` `ca_cert_data`  parameter too.  This can be passed when creating the [`PoolManager`](https://urllib3.readthedocs.io/en/stable/reference/urllib3.poolmanager.html#urllib3.PoolManager) in our codebase. 

### End goal

I would prefer to have this support in requests library where every usage of `verify` also accepts a `list/tuple`. If that happens, [`cert_verify`](https://github.com/psf/requests/blob/cdbc2e271529f467b278b2760f12ee0b5d6930d3/requests/adapters.py#L237) should correctly configure the `urllib3.connectionpool.HTTPSConnectionPool` object to read ca_bundle_data `from all files`.

```
import requests
requests.get("https://www.google.com", verify=["/path/to/bundle1", "/path/to/bundle2"])
```

I didn't fully explore the codebase to understand what would be the right way to implement this, but I was wondering what the community thinks about this feature? If it's acceptable, it'll be great if someone can give suggestions on the next steps and I can attempt to make it happen.

This library is (and has been under for years) a feature freeze. More than anything we're not accepting changes to the top level API like this. I agree that I can see the value but there are also many ways to solve this today. 

@sigmavirus24 Thank you for the response. I wasn't aware that it's under feature freeze.

Could you suggest a way to accomplish this without creating a custom bundle collection on disk? (Not asking for a complete example, just explanation)

If the requirement is to use one session for everything, you can use adapters that are mounted with the right bundle paths for each request to the session such that they use the right bundle. 

You still get connection pooling and then you also get the bundle level control you seem to want at the session level 

>you can use adapters that are mounted with the right bundle paths for each request to the session such that they use the right bundle.

In my case, I want one "object" to support endpoints with both public and private CA. This requirement was raised as I'm migrating endpoints from public CA to private CA. So, at a given moment, during migration phase, one endpoint can either present a public or a private CA. 

I'll continue to explore, for now, I don't have an elegant answer without creating a temporary bundle file on disk. I understand the problem, I somehow have to set `ca_cert_data` in `urllib3.connection.HTTPSConnection`, just not sure what's the right way with requests library. 

I'll appreciate if I can get any pointers @sigmavirus24. 

> >you can use adapters that are mounted with the right bundle paths for each request to the session such that they use the right bundle.
> 
> In my case, I want one "object" to support endpoints with both public and private CA. This requirement was raised as I'm migrating endpoints from public CA to private CA. So, at a given moment, during migration phase, one endpoint can either present a public or a private CA. 
> 
> I'll continue to explore, for now, I don't have an elegant answer without creating a temporary bundle file on disk. I understand the problem, I somehow have to set `ca_cert_data` in `urllib3.connection.HTTPSConnection`, just not sure what's the right way with requests library. 
> 
> I'll appreciate if I can get any pointers @sigmavirus24. 

A single session can have many adapters thus one object.

You didn't raise the concern of using bundles in memory, which we don't support. If that's a requirement, you can create your own SSLContext which you can call `ca_cert_data` on for an adapter to use. And mount that adapter.

I'm not writing example code because I'm on my phone taking care of my partner recovering from major surgery. The documentation clearly describes how to use adapters with a single session and if you're already reading internals, you can probably figure out what the adapter code needs to look like if you subclass HTTPAdapter

While this is an [older article about configuring TLS](https://lukasa.co.uk/2017/02/Configuring_TLS_With_Requests/), it has what you'd need to write your own adapter. I believe this should be relatively straight forward as sigmavirus24 noted. I'll resolve this with that information since I don't believe there's anything else for us to do currently.