caroot: regenerate the root bundle with OpenSSL 3

No functional change intended.

caroot: drop the VERSION tag from already-processed certs

An update is imminent; drop these now to make it easier to audit the
results.

caroot: update the root bundle

Summary:
- Zero (0) newly trusted
- Five (5) modified
- Nine (9) distrusted

MFC after: 3 days