Remove support for certifi

As per #1105, certifi is being end-of-lifed. Requests will use either
its own vendored bundle, or possibly (when packaged with OS distributions)
an externally packaged bundle, which can be enabled by patching
requests.certs.where().