caroot: regenerate the root bundle with OpenSSL 3

No functional change intended.

caroot: update the root bundle

Summary:
- Six (6) new roots
- Four (4) distrusted roots

Note that this was intentionally generated with OpenSSL 1.1.1 to avoid
mixing updates and non-functional changes -- there will be some churn
with OpenSSL 3. The next commit will update the current batch of
trusted certs with the format OpenSSL 3 produces, which I've tested
against OpenSSL 1.1.1 to be sure that that doesn't hurt us in older
branches.