devel/arcanist-lib: Drop ca_root_nss dependency.

This was much harder than it needs to be, because Arcanist is dead set
on forcing a CA bundle instead of letting curl pick one or use the OS
native trust store. Remove the enforced fallback and set CURL_CAINFO
only if a CA bundle was explicitly configured or custom.pem was found
on disk. Furthermore, if the configured value is a directory, set
CURL_CAPATH instead.

MFH: 2023Q4
Reviewed by: grembo
Differential Revision: https://reviews.freebsd.org/D42042