caroot: cumulative cert update

This adds a note in all existing certs that they are explicitly trusted
for server auth, and also:

- Seven (7) added
- Nineteen (19) removed

(cherry picked from commit 446169e0b6f04b96960540784539c218f5a14c86)
(cherry picked from commit 3016c5c2bf68d8c6ebf303939f20092478e7a4ca)
(cherry picked from commit fac832b27105d926d9f8728d7147adb547b937d8)
(cherry picked from commit 76461921dac18b300489e326ba3df61d2809f364)

Git Hash: de140815c9a583e8eb702b39cd8f57ca81a05e3f
Git Author: kevans@FreeBSD.org

MFC r353095, r355376: add root bundle

r353095:
caroot: commit initial bundle

Interested users can blacklist any/all of these with certctl(8), examples:

- mv /usr/share/certs/trusted/... /usr/share/certs/blacklisted/...; \
certctl rehash
- certctl blacklist /usr/share/certs/trusted/*; \
certctl rehash

Certs can be easily examined after installation with `certctl list`, and
certctl blacklist will accept the hashed filename as output by list or as
seen in /etc/ssl/certs

r355376:
caroot update to latest tip: one (1) addition, none (0) removed

Added:
- Entrust Root Certification Authority - G4

Relnotes: yes, please