mercurial: Update to 2.6.1

Also, set a default for web.cacerts so that the system certificates on
NixOS are used.
cacert: Update to 20121229