Backport: Newer Root CA for rubygems.org

Due sunsetting of certificates with SHA1 signature, rubygems.org
is upgrading, which requires RubyGems (the software) be ugpraded
too.