Improve handling of CA certificates (#518)

Instead of bundling Pkl's built-in CA certificates as a class path resource and loading them at runtime,
pass them to the native image compiler as the default SSL context's trust store.
This results in faster SSL initialization and is more consistent with how default certificates
are handled when running on the JVM.

Further related improvements:
- Remove HttpClientBuilder methods `addDefaultCliCertificates` and `addBuiltInCertificates`.
- Remove pkl-certs subproject and the optional dependencies on it.
- Move `PklCARoots.pem` to `pkl-cli/src/certs`.
- Fix certificate related error messages that were missing an argument.
- Prevent PklBugException if initialization of `CliBaseOptions.httpClient` fails.
- Add ability to set CA certificates as a byte array
- Add CA certificates option to message passing API

pkl-cli/src/test/kotlin/org/pkl/cli/CliEvaluatorTest.kt

@@ -1260,10 +1260,7 @@ result = someLib.x
 
   @Test
   fun `gives decent error message if CLI doesn't have the required CA certificate`() {
-    // provide SOME certs to prevent CliEvaluator from falling back to ~/.pkl/cacerts
-    val builtInCerts = FileTestUtils.writePklBuiltInCertificates(tempDir)
-    val err =
-      assertThrows<CliException> { evalModuleThatImportsPackage(builtInCerts, packageServer.port) }
+    val err = assertThrows<CliException> { evalModuleThatImportsPackage(null, packageServer.port) }
     assertThat(err)
       .hasMessageContaining("Error during SSL handshake with host `localhost`:")
       .hasMessageContaining("unable to find valid certification path to requested target")
@@ -1460,7 +1457,7 @@ result = someLib.x
     assertThat(output).isEqualTo("result = 1\n")
   }
 
-  private fun evalModuleThatImportsPackage(certsFile: Path, testPort: Int = -1) {
+  private fun evalModuleThatImportsPackage(certsFile: Path?, testPort: Int = -1) {
     val moduleUri =
       writePklFile(
         "test.pkl",
@@ -1475,7 +1472,7 @@ result = someLib.x
       CliEvaluatorOptions(
         CliBaseOptions(
           sourceModules = listOf(moduleUri),
-          caCertificates = listOf(certsFile),
+          caCertificates = buildList { if (certsFile != null) add(certsFile) },
           workingDir = tempDir,
           noCache = true,
           testPort = testPort