caextract: add changelog

The changelog now details the two particular updates done this year that
both affected the cacert.pem output