This was much harder than it needs to be, because Arcanist is dead set
on forcing a CA bundle instead of letting curl pick one or use the OS
native trust store. Remove the enforced fallback and set CURL_CAINFO
only if a CA bundle was explicitly configured or custom.pem was found
on disk. Furthermore, if the configured value is a directory, set
CURL_CAPATH instead.