Update the CA; pin on GlobalSign's root

With this change, all existing installs will be updated to pin GlobalSign's root CA. We use that to fetch plugins from fred but also in the last-resort update scripts
It's just reducing the number of pins from 3 to 1...

At a later stage we can/should be renaming the file... but that's a separate change imho