caroot: regenerate the root bundle with OpenSSL 3

No functional change intended.

caroot: drop the VERSION tag from already-processed certs

An update is imminent; drop these now to make it easier to audit the
results.

caroot: update root store

- Four (4) added
- Two (2) removed