ca-certificates: Clean old neutral-trust.crt and supplement.p11-kit before adding new