curl: support embedding a CA bundle

Add the ability to embed a CA bundle into the curl binary. It is used
when no other runtime or build-time option set one.

This helps curl-for-win macOS and Linux builds to run standalone, and
also helps Windows builds to avoid picking up the CA bundle from an
arbitrary (possibly world-writable) location (though this behaviour is
not currently disablable).

Usage:
- cmake: `-DCURL_CA_EMBED=/path/to/curl-ca-bundle.crt`
- autotools: `--with-ca-embed=/path/to/curl-ca-bundle.crt`
- Makefile.mk: `CURL_CA_EMBED=/path/to/curl-ca-bundle.crt`

Also add new command-line option `--dump-ca-embed` to dump the embedded
CA bundle to standard output.

Closes #14059

src/tool_help.c

@@ -244,10 +244,28 @@ void tool_version_info(void)
     puts(""); /* newline */
   }
   if(feature_names[0]) {
-    printf("Features:");
-    for(builtin = feature_names; *builtin; ++builtin)
-      printf(" %s", *builtin);
-    puts(""); /* newline */
+    const char **feat_ext;
+    size_t feat_ext_count = feature_count;
+#ifdef CURL_CA_EMBED
+    ++feat_ext_count;
+#endif
+    feat_ext = malloc(sizeof(*feature_names) * (feat_ext_count + 1));
+    if(feat_ext) {
+      memcpy((void *)feat_ext, feature_names,
+             sizeof(*feature_names) * feature_count);
+      feat_ext_count = feature_count;
+#ifdef CURL_CA_EMBED
+      feat_ext[feat_ext_count++] = "CAcert";
+#endif
+      feat_ext[feat_ext_count] = NULL;
+      qsort((void *)feat_ext, feat_ext_count, sizeof(*feat_ext),
+            struplocompare4sort);
+      printf("Features:");
+      for(builtin = feat_ext; *builtin; ++builtin)
+        printf(" %s", *builtin);
+      puts(""); /* newline */
+      free((void *)feat_ext);
+    }
   }
   if(strcmp(CURL_VERSION, curlinfo->version)) {
     printf("WARNING: curl and libcurl versions do not match. "