security/ca_root_nss: Make the certctl command overridable

For some purposes it's useful to be able to build the ca_root_nss with a
custom certctl command. It may be desireable for instance to run
certctl rehash at the end of a package upgrade rather than in the
middle, in which case it's sufficient to substitute CERTCTL_CMD=:.

Make the certctl command name a variable so that one can override it at
port build time. No functional change intended.

PR: 290115
Approved by: maintainer (timeout, 1 month)
Sponsored by: OPNsense
Sponsored by: Klara, Inc.