caroot: regenerate the root bundle with OpenSSL 3

No functional change intended.

caroot: drop the VERSION tag from already-processed certs

An update is imminent; drop these now to make it easier to audit the
results.

secure/caroot, certctl: Rename secure/caroot/blacklisted

Old certctl commands still work for compatability, but are deprecated.

Approved by: secteam (gordon)
Differential Revision: https://reviews.freebsd.org/D30807