curl: add options for safe/no CA bundle search (Windows)

Add `CURL_CA_SEARCH_SAFE` build-time option to enable CA bundle search
in the `curl` tool directory. The lookup method was already used to find
`.curlrc` and `_curlrc` (on Windows). On Windows it overrides the unsafe
default `SearchPath()` method.

Enable with:
- cmake: `-DCURL_CA_SEARCH_SAFE=ON`
- autotools: `--enable-ca-search-safe`
- raw: `CPPFLAGS=-DCURL_CA_SEARCH_SAFE`

On Windows, before this patch the whole `PATH` was searched for
a CA bundle. `PATH` may contain unwanted or world-writable locations,
including the current directory. Searching them all is convenient to
pick up any CA bundle, but not secure.

The Muldersoft curl distro implements such CA search via a custom
patch for Windows:
cd652d4792/patch/curl_tool_doswin.diff (L50)

MSYS2/mingw-w64 distro has also been rolling a patch solving this:
https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-curl/0001-Make-cURL-relocatable.patch
https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-curl/pathtools.c

Also add option to fully disable Windows CA search:
- cmake: `-DCURL_DISABLE_CA_SEARCH=ON`
- autotools: `--disable-ca-search`
- raw: `CPPFLAGS=-DCURL_DISABLE_CA_SEARCH`.

Both options are considered EXPERIMENTAL, with possible incompatible
changes or even (partial) removal in the future, depending on feedback.

An alternative, secure option is to embed the CA bundle into the binary.

Safe search can be extended to other platforms if necessary or useful,
by using `_NSGetExecutablePath()` (macOS),
`/proc/self/exe` (Linux/Cygwin), or `argv[0]`.

Closes #14582

docs/CURL-DISABLE.md

@@ -42,6 +42,10 @@ Disable support for the negotiate authentication methods.
 
 Disable **AWS-SIG4** support.
 
+## `CURL_DISABLE_CA_SEARCH`
+
+Disable unsafe CA bundle search in PATH on Windows.
+
 ## `CURL_DISABLE_DICT`
 
 Disable the DICT protocol

docs/SSLCERTS.md

@@ -65,6 +65,9 @@ cert file named `curl-ca-bundle.crt` in these directories and in this order:
   4. Windows Directory (e.g. C:\Windows)
   5. all directories along %PATH%
 
+curl 8.11.0 added a build-time option to disable this search behavior, and
+another option to restrict search to the application's directory.
+
 ### Use the native store
 
 In several environments, in particular on Windows, you can ask curl to use the

docs/cmdline-opts/cacert.md

@@ -27,10 +27,13 @@ curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is set
 and the TLS backend is not Schannel, and uses the given path as a path to a CA
 cert bundle. This option overrides that variable.
 
-The Windows version of curl automatically looks for a CA certs file named
+(Windows) curl automatically looks for a CA certs file named
 'curl-ca-bundle.crt', either in the same directory as curl.exe, or in the
 Current Working Directory, or in any folder along your PATH.
 
+curl 8.11.0 added a build-time option to disable this search behavior, and
+another option to restrict search to the application's directory.
+
 (iOS and macOS only) If curl is built against Secure Transport, then this
 option is supported for backward compatibility with other SSL engines, but it
 should not be set. If the option is not set, then curl uses the certificates