Improve handling of CA certificates (#518)

Instead of bundling Pkl's built-in CA certificates as a class path resource and loading them at runtime,
pass them to the native image compiler as the default SSL context's trust store.
This results in faster SSL initialization and is more consistent with how default certificates
are handled when running on the JVM.

Further related improvements:
- Remove HttpClientBuilder methods `addDefaultCliCertificates` and `addBuiltInCertificates`.
- Remove pkl-certs subproject and the optional dependencies on it.
- Move `PklCARoots.pem` to `pkl-cli/src/certs`.
- Fix certificate related error messages that were missing an argument.
- Prevent PklBugException if initialization of `CliBaseOptions.httpClient` fails.
- Add ability to set CA certificates as a byte array
- Add CA certificates option to message passing API

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliCommand.kt

@@ -15,8 +15,10 @@
  */
 package org.pkl.commons.cli
 
+import java.nio.file.Files
 import java.nio.file.Path
 import java.util.regex.Pattern
+import kotlin.io.path.isRegularFile
 import org.pkl.core.*
 import org.pkl.core.evaluatorSettings.PklEvaluatorSettings
 import org.pkl.core.http.HttpClient
@@ -166,6 +168,13 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
     cliOptions.noProxy
       ?: project?.evaluatorSettings?.http?.proxy?.noProxy ?: settings.http?.proxy?.noProxy
 
+  private fun HttpClient.Builder.addDefaultCliCertificates() {
+    val caCertsDir = IoUtils.getPklHomeDir().resolve("cacerts")
+    if (Files.isDirectory(caCertsDir)) {
+      Files.list(caCertsDir).filter { it.isRegularFile() }.forEach { addCertificates(it) }
+    }
+  }
+
   /**
    * The HTTP client used for this command.
    *

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliMain.kt

@@ -16,6 +16,7 @@
 package org.pkl.commons.cli
 
 import java.io.PrintStream
+import java.security.Security
 import kotlin.system.exitProcess
 
 /** Building block for CLIs. Intended to be called from a `main` method. */
@@ -29,6 +30,8 @@ fun cliMain(block: () -> Unit) {
 
   // Force `native-image` to use system proxies (which does not happen with `-D`).
   System.setProperty("java.net.useSystemProxies", "true")
+  // enable OCSP for default SSL context
+  Security.setProperty("ocsp.enable", "true")
 
   try {
     block()