ca-bundle.crt: updated to mozilla state

Kathleen Wilson's words:

The websites and code signing trust bits were turned off for that 1024-bit root.

See
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.16.3_release_notes
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.16.4_release_notes

Kai blogged about the 1024-bit root changes here:
https://kuix.de/blog/index.php?entry=Cleanup-of-1024-bit-CA-certificates
But I think he forgot to mention the roots for which we turned off the
websites and code signing trust bits.