Add certifi to the deps in thin tarball

This solves the problem of debian not sending the right cert data down if certifi is installed
Fix #16773