curl: add --ca-native and --proxy-ca-native

These are two boolean options to ask curl to use the native OS's CA
store when verifying TLS servers. For peers and for proxies
respectively.

They currently only have an effect for curl on Windows when built to use
OpenSSL for TLS.

Closes #11049

docs/cmdline-opts/Makefile.inc

@@ -30,6 +30,7 @@ DPAGES = \
   append.d \
   aws-sigv4.d \
   basic.d \
+  ca-native.d \
   cacert.d \
   capath.d \
   cert-status.d \
@@ -170,6 +171,7 @@ DPAGES = \
   proto.d \
   proxy-anyauth.d \
   proxy-basic.d \
+  proxy-ca-native.d \
   proxy-cacert.d \
   proxy-capath.d \
   proxy-cert-type.d \

docs/cmdline-opts/ca-native.d

@@ -0,0 +1,19 @@
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: ca-native
+Help: Use CA certificates from the native OS
+Protocols: TLS
+Category: tls
+See-also: cacert capath insecure
+Example: --ca-native $URL
+Added: 8.2.0
+Multi: boolean
+---
+Tells curl to use the CA store from the native operating system to verify the
+peer. By default, curl will otherwise use a CA store provided in a single file
+or directory, but when using this option it will interface the operating
+system's own vault.
+
+This option only works for curl on Windows when built to use OpenSSL. When
+curl on Windows is built to use Schannel, this feature is implied and curl
+then only uses the native CA store.

docs/cmdline-opts/proxy-ca-native.d

@@ -0,0 +1,19 @@
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Long: proxy-ca-native
+Help: Use CA certificates from the native OS for proxy
+Protocols: TLS
+Category: tls
+See-also: cacert capath insecure
+Example: --ca-native $URL
+Added: 8.2.0
+Multi: boolean
+---
+Tells curl to use the CA store from the native operating system to verify the
+HTTPS proxy. By default, curl will otherwise use a CA store provided in a
+single file or directory, but when using this option it will interface the
+operating system's own vault.
+
+This option only works for curl on Windows when built to use OpenSSL. When
+curl on Windows is built to use Schannel, this feature is implied and curl
+then only uses the native CA store.

docs/options-in-versions

@@ -16,6 +16,7 @@
 --append (-a)                        4.8
 --aws-sigv4                          7.75.0
 --basic                              7.10.6
+--ca-native                          8.2.0
 --cacert                             7.5
 --capath                             7.9.8
 --cert (-E)                          5.0
@@ -157,6 +158,7 @@
 --proxy (-x)                         4.0
 --proxy-anyauth                      7.13.2
 --proxy-basic                        7.12.0
+--proxy-ca-native                    8.2.0
 --proxy-cacert                       7.52.0
 --proxy-capath                       7.52.0
 --proxy-cert                         7.52.0