pv-runtime: Add a mechanism to take custom CA certificates from the host

This is intended to be a developer-only feature, so it makes some assumptions about the host system: we assume that there is a Debian-compatible TLS certificate store (as seen on e.g. Debian and Arch) with a CAfile at /etc/ssl/certs/ca-certificates.crt and a CApath at /etc/ssl/certs. There is no attempt to make this as robust as we would usually want for an end-user-facing feature, and it will fail hard (exit with an error) rather than trying to continue in the face of adversity.

steamrt/tasks#416

/cc @timo