Update bundled CA certificates

[devnoname120]

Summary

• refresh the external Mozilla/curl CA bundle to the May 14, 2026 extract
• preserve the original Vita/Sony/default certificate prefix byte-for-byte
• keep the repo's existing structure of OFW certificates first, then external Mozilla roots, so Sony/PS Store compatibility priority is unchanged

Notes

The refreshed external PEM blocks match the current curl.se/ca/cacert.pem certificate material. The total PEM block count changes from 202 to 188 because the current Mozilla/curl bundle removes older roots and adds newer ones; the preserved Vita/Sony/default prefix remains 67 certificates.

Validation

• openssl crl2pkcs7 -nocrl -certfile misc/certs.cer | openssl pkcs7 -print_certs -noout | rg -c '^subject=' -> 188
• compared the Vita/Sony/default prefix against origin/master; no diff
• compared refreshed external PEM blocks against current https://curl.se/ca/cacert.pem after stripping comments/CRLF; no diff
• make -n confirms misc/certs.cer is still packaged as certs.cer