ca-bundle: install a generated ca-cert bundle for curl

On OSX git calls curl from hashstack, it will fail on https based
repositories if SSL verification is left to the default value of
true.

This commit pulls in a generated ca cert bundle generated from with
the mk-ca-bundle.pl that ships with curl.

It is probably better to ship a semi-regularly updated ca-bundle
than to tell users to turn off verification that verification of
ssl based services are broken.

This commit also disables additional tools installed by the golang
package.

Signed-off-by: Jimmy Tang <jcftang@gmail.com>
Maintaining a CRL would mean very regular updates of the ca-bundle package or running a CRL daemon of some sort which updates a local CRL database/file.

Looking at how homebrew and archlinux build curl, they don't seem to 'enable' nss anywhere unless curl just assumes that it's there in the underlying platform and its picking it up automagically.