Revert r360395: MFC r353095, r355376: add root bundle

certctl(8) demonstrably has some logistics issues that still need to be
worked out, as pointed out in at least PR 228913, 246614. I do not feel
comfortable with proceeding with my original plan for the impending
release without resolving at least PR 246614 and being able to get the
release(7) scripts into a state where they're producing VM images that
more closesly resemble a bsdinstall-produced install.

11.4 will still maintain the current version of certctl(8) that works well
for most cases, and it still includes the caroot infrastructure.

I do not currently intend to revert this in stable/11, as I would still
like folks along stable/11 to be able to participate in Q/A'ing this
feature.

Approved by: re (gjb)