respect SSL_CERT_DIR/SSL_CERT_FILE if present
simplify by ssl ca defaults

still attempt to add default paths, but always add bundled
I believe bundled should only be used as a fallback then
which should match with desire and more generally 'just work'

if this fails we may have to explore something like this:
https://github.com/google/signet/blob/master/lib/signet/ssl_config.rb