Bump ca-certificates version.
Do not duplicate find-links already present in stack/slapos.cfg .
Any slapos SR may need to use xz-friendly h.r.download .