Safer URL decoding.

Some URLs may use the % character for other purposes than URL-encoding
(this is seen in some data URLs). Make sure we parse that properly, and
avoid a possible out of bounds access if the percent char is near the
end of the string.
Data URLs: parse the whole URL, not just the path.

The RFC for Data URLs specifies a nonstandard format, and because of
this it doesn't support queries and fragments. This allows the use of
the # and ? characters in the URL data. We didn't handle this properly,
which would lead to truncated data.
Replace broken curl and ca_root_certificates

* Remove unneeded path mashup in curl to find the ca_root_certificates
and use the file in .self/data/ssl. This makes it possible to rename the
package providing ca_root_certificates without everything exploding.
* Use a certificate file in the format cURL expects, not Mozilla source
file in NSS format.