pin project to mozilla's certificate store via debian

Turns out we don't really have the resources or power to fully curate
our own CA store. So, instead, we will use Mozilla's CA store as pulled
through Debian's ca-certificates package.

We do this by fetching the git source of ca-certificates, verifying the
latest git tag, then building the trusted PEM list from Mozilla's store.