curl: support embedding a CA bundle

Add the ability to embed a CA bundle into the curl binary. It is used
when no other runtime or build-time option set one.

This helps curl-for-win macOS and Linux builds to run standalone, and
also helps Windows builds to avoid picking up the CA bundle from an
arbitrary (possibly world-writable) location (though this behaviour is
not currently disablable).

Usage:
- cmake: `-DCURL_CA_EMBED=/path/to/curl-ca-bundle.crt`
- autotools: `--with-ca-embed=/path/to/curl-ca-bundle.crt`
- Makefile.mk: `CURL_CA_EMBED=/path/to/curl-ca-bundle.crt`

Also add new command-line option `--dump-ca-embed` to dump the embedded
CA bundle to standard output.

Closes #14059

src/tool_listhelp.c

@@ -165,6 +165,9 @@ const struct helptxt helptext[] = {
   {"    --doh-url <URL>",
    "Resolve hostnames over DoH",
    CURLHELP_DNS},
+  {"    --dump-ca-embed",
+   "Write the embedded CA bundle to standard output",
+   CURLHELP_HTTP | CURLHELP_PROXY | CURLHELP_TLS},
   {"-D, --dump-header <filename>",
    "Write the received headers to <filename>",
    CURLHELP_HTTP | CURLHELP_FTP},