caroot: cumulative cert update
This adds a note in all existing certs that they are explicitly trusted
for server auth, and also:
- Seven (7) added
- Nineteen (19) removed
(cherry picked from commit 446169e0b6f04b96960540784539c218f5a14c86)
(cherry picked from commit 3016c5c2bf68d8c6ebf303939f20092478e7a4ca)
(cherry picked from commit fac832b27105d926d9f8728d7147adb547b937d8)
(cherry picked from commit 76461921dac18b300489e326ba3df61d2809f364)