Pin ca-certificates curl license provenance

[jacklv-coder]

Summary

• pin the exact curl mk-ca-bundle.pl revision that is byte-identical to the script shipped in ca-certificates-20230506.tar.bz2
• pin the matching curl COPYING grant and bind both payloads into the checksum-reviewed license/NOTICE evidence set
• update generated compliance artifacts, bilingual documentation, validators, and regression tests for 13 remote payloads / 80 reviewed payload files

Scope and gates

• keeps certificate attribution and trust-store requirements open
• keeps legal review, corresponding-source delivery review, and redistribution approval open
• does not add the RootFS payload to the app bundle

Validation

• codex review --base origin/main: no actionable correctness issues
• all Ruby script test suites passed
• ./Scripts/test.sh: 139 tests, 1 environment-gated skip, 0 failures
• bash Scripts/check-docs.sh passed
• external 80-file evidence tree materialization and review verification passed
• compliance generator --check reproduced all 13 generated files
• git diff --check passed

[jacklv-coder]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 0432983986

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".