nss: make the list of CRL items global

Otherwise NSS could use an already freed item for another connection.