fdo#72277: Use NSS CACERT in cmis ucp with internal curl

This fix contains two parts:
  * initialize NSS in the CMIS UCP right before sending an HTTP request
    in case internal curl is used. This makes internal curl find the NSS
    CACERT database from the user mozilla profile.

  * add nsspem to allow curl to use CACERTs from libnssckbi. Without
    libnsspem curl is unable to read the certificates from the NSS
    database. The nss-pem code has been extracted from the fedora-hosted
    repository: https://git.fedorahosted.org/cgit/nss-pem.git

System CURL will know how to get the CA bundle from the system openSSL.
There is no need to have internal NSS CA database support and thus
build nsspem.

(cherry picked from commit 165075e0d705cbd146463c94b027e728db864ab2)
(cherry picked from commit 6602f904ac1858ef571eab5b2df733be0461e7e3)
(cherry picked from commit 85d1bd151cca1572e39019288cb2b7b35fc0bbda)
(cherry picked from commit 0058b4370070c96e1edc9dd3c80715187ad30cca)
(cherry picked from commit a8fd30771a019f727b07adfd82d610028f640f1e)
(cherry picked from commit 89361fa68af9a6854dc3a07711279f27561ea8fb)

Conflicts:
	external/nss/UnpackedTarball_nss.mk

Change-Id: Ie8dedf020480cca01bf9761382886566a1150778
Reviewed-on: https://gerrit.libreoffice.org/10364
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Miklos Vajna <vmiklos@collabora.co.uk>