curl: support embedding a CA bundle

Add the ability to embed a CA bundle into the curl binary. It is used
when no other runtime or build-time option set one.

This helps curl-for-win macOS and Linux builds to run standalone, and
also helps Windows builds to avoid picking up the CA bundle from an
arbitrary (possibly world-writable) location (though this behaviour is
not currently disablable).

Usage:
- cmake: `-DCURL_CA_EMBED=/path/to/curl-ca-bundle.crt`
- autotools: `--with-ca-embed=/path/to/curl-ca-bundle.crt`
- Makefile.mk: `CURL_CA_EMBED=/path/to/curl-ca-bundle.crt`

Also add new command-line option `--dump-ca-embed` to dump the embedded
CA bundle to standard output.

Closes #14059

src/Makefile.mk

@@ -45,6 +45,11 @@ TARGETS := curl$(BIN_EXT)
 
 CURL_CFILES += $(notdir $(CURLX_CFILES))
 
+ifneq ($(CURL_CA_EMBED),)
+CPPFLAGS += -DCURL_CA_EMBED
+CURL_CFILES += tool_ca_embed.c
+endif
+
 curl_OBJECTS := $(patsubst %.c,$(OBJ_DIR)/%.o,$(strip $(CURL_CFILES)))
 ifdef MAP
 CURL_MAP := curl.map
@@ -57,8 +62,9 @@ TOCLEAN := $(curl_OBJECTS)
 
 ### Rules
 
-ifneq ($(wildcard tool_hugehelp.c.cvs),)
 PERL  ?= perl
+
+ifneq ($(wildcard tool_hugehelp.c.cvs),)
 NROFF ?= groff
 
 TOCLEAN += tool_hugehelp.c
@@ -84,6 +90,12 @@ tool_hugehelp.c:
 endif
 endif
 
+ifneq ($(CURL_CA_EMBED),)
+TOCLEAN += tool_ca_embed.c
+tool_ca_embed.c: mk-file-embed.pl
+	$(PERL) mk-file-embed.pl --var curl_ca_embed < $(CURL_CA_EMBED) > $@
+endif
+
 $(TARGETS): $(curl_OBJECTS) $(PROOT)/lib/libcurl.a
 	$(CC) $(LDFLAGS) -o $@ $(curl_OBJECTS) $(LIBS)