This was much harder than it needed to be, because Arcanist is dead set
on forcing a CA bundle instead of letting curl pick one or use the OS
native trust store. Remove most of the incorrect logic and set CAINFO
only if a CA bundle was explicitly configured.