store/certifi: initial support

[adamdecaf]

certifi (http://certifi.io/ -- doesn't load) is an embedded cert store with a few language bindings.

• node
• ruby
• erlang
• python
• go

Found while investigating https://github.com/adamdecaf/cert-manage/issues/59

[adamdecaf]

Python:

This library is embedded in a requests python lib, which is vendored into pip.

It seems to be located at directories like (on OSX):

• /Library/Python/2.7/site-packages/certifi/cacert.pem
• /Library/Python/2.7/site-packages/pip/_vendor/requests/cacert.pem

[adamdecaf]

Go:

The certs are embedded within the compiled binary: https://github.com/certifi/gocertifi/blob/master/certifi.go#L4617

[adamdecaf]

For bundles that are just reading from a gem/pip on disk we should be able to copy the original to cacert.pem.backup and then rewrite cacert.pem according to the whitelist.

Then either a gem/pip reinstall or restore command would bring back the original pool.