ssl: support Apple SecTrust configurations

- configure/cmake support for enabling the option
- supported in OpenSSL and GnuTLS backends
- when configured, Apple SecTrust is the default trust store
  for peer verification. When one of the CURLOPT_* for adding
  certificates is used, that default does not apply.
- add documentation of build options and SSL use

Closes #18703

docs/INSTALL.md

@@ -153,6 +153,25 @@ conflicting identical symbol names.
 When you build with multiple TLS backends, you can select the active one at
 runtime when curl starts up.
 
+### Selecting TLS Trust Anchors Defaults
+
+Verifying a server certificate established a chain of trust that needs to
+start somewhere. Those "root" certificates make the set of Trust Anchors.
+
+While the build system tries to find good defaults on the platform you
+use, you may specify these explicitly. The following options are provided:
+
+ - `--with-ca-bundle=FILE`: the file that libcurl loads default root
+ certificates from.
+ - `--with-ca-path=DIRECTORY`: a directory in which root certificates files
+ are found.
+ - `--with-ca-embed=FILE`: a file read *at build time* and added to `libcurl`.
+ - `--with-ca-fallback`: an OpenSSL specific option for delegating default
+ trust anchor selection to what OpenSSL thinks is best, *if* there are
+no other certificates configured by the application.
+ - `--with-apple-sectrust`: use the system "SecTrust" service on Apple
+ operating systems for verification. (Added in 8.17.0)
+
 ## MultiSSL and HTTP/3
 
 HTTP/3 needs QUIC and QUIC needs TLS. Building libcurl with HTTP/3 and QUIC