Bootstrap: use 'certifi' package to obtain up-to-date root CA list.

The default root CA store on our Windows CI builders does not
trust static.rust-lang.org

python/requirements.txt

@@ -26,4 +26,9 @@ colorama == 0.3.7
 # For package uploading
 boto3 == 1.4.4
 
+# Default root CAs on Windows CI do not trust CloudFront certificates,
+# connecting to https://static.rust-lang.org would fail:
+# https://github.com/servo/servo/pull/18942
+certifi
+
 -e python/tidy

python/servo/util.py

@@ -19,6 +19,7 @@ import sys
 import tarfile
 import zipfile
 import urllib2
+import certifi
 
 
 def delete(path):
@@ -73,7 +74,7 @@ def download(desc, src, writer, start_byte=0):
         req = urllib2.Request(src)
         if start_byte:
             req = urllib2.Request(src, headers={'Range': 'bytes={}-'.format(start_byte)})
-        resp = urllib2.urlopen(req)
+        resp = urllib2.urlopen(req, cafile=certifi.where())
 
         fsize = None
         if resp.info().getheader('Content-Length'):