Blacklist more flags that clang does not support

Fixes #28680.
Remove curl-ca-bundle

This is no longer used by anything in core.

The openssl formula provides a cert file that is bootstrapped using
certificates from the system keychain.

Additional certificates can be added in
  $(brew --prefix)/etc/openssl/certs

where they will be picked up by openssl.

Closes #28658.
openssl: simplify CA file bootstrap
openssl: add instructions for using custom certs