Switch to rustls and webpki-roots (#30025)

This change replaces OpenSSL with rustls and also the manually curated
CA certs file with webpki-roots (effectively the same thing, but as a
crate).

Generally speaking the design of the network stack is the same. Changes:

- Code around certificate overrides needed to be refactored to work with
  rustls so the various thread-safe list of certificates is refactored
  into `CertificateErrorOverrideManager`
- hyper-rustls takes care of setting ALPN protocols for HTTP requests,
  so for WebSockets this is moved to the WebSocket code.
- The safe set of cypher suites is chosen, which seem to correspond to
  the "Modern" configuration from [1]. This can be adjusted later.
- Instead of passing a string of PEM CA certificates around, an enum is
  used that includes parsed Certificates (or the default which reads
  them from webpki-roots).
- Code for starting up an SSL server for testing is cleaned up a little,
  due to the fact that the certificates need to be overriden explicitly
  now. This is due to the fact that the `webpki` crate is more stringent
  with self-signed certificates than SSL (CA certificates cannot used as
  end-entity certificates). [2]

1. https://wiki.mozilla.org/Security/Server_Side_TLS
2. https://github.com/briansmith/webpki/issues/114

Fixes #7888.
Fixes #13749.
Fixes #26835.
Fixes #29291.

etc/cert_generator.js

@@ -1,75 +0,0 @@
-// XPCShell script for generating a single file containing all certificates in PEM
-// format. You may run this in the browser toolbox's console
-// (Firefox -> devtools -> settings -> enable remote/chrome debugging,
-// followed by settings -> devtools menu -> browser toolbox) or the 
-// xpcshell runner that comes with a built Firefox (./run-mozilla.sh ./xpcshell).
-// The variable `certstring` contains the final pem file. You can use `save(path)` to
-// save it to a file. `certlist` contains an array with the PEM certs as well as their names if you
-// want to filter them.
-
-
-// http://mxr.mozilla.org/mozilla-central/source/security/manager/pki/resources/content/pippki.js
-function getDERString(cert)
-{
-  var length = {};
-  var derArray = cert.getRawDER(length);
-  var derString = '';
-  for (var i = 0; i < derArray.length; i++) {
-    derString += String.fromCharCode(derArray[i]);
-  }
-  return derString;
-}
-
-// http://mxr.mozilla.org/mozilla-central/source/security/manager/pki/resources/content/pippki.js
-function getPEMString(cert)
-{
-  var derb64 = btoa(getDERString(cert));
-  // Wrap the Base64 string into lines of 64 characters, 
-  // with CRLF line breaks (as specified in RFC 1421).
-  var wrapped = derb64.replace(/(\S{64}(?!$))/g, "$1\r\n");
-  return "-----BEGIN CERTIFICATE-----\r\n"
-         + wrapped
-         + "\r\n-----END CERTIFICATE-----\r\n";
-}
-
-let certdb = Components.classes["@mozilla.org/security/x509certdb;1"].createInstance(Ci.nsIX509CertDB);
-let enumerator = certdb.getCerts().getEnumerator();
-let certlist = [];
-let certstring="";
-while(enumerator.hasMoreElements()){
-  let cert = enumerator.getNext().QueryInterface(Ci.nsIX509Cert);
-  let pem = getPEMString(cert);
-  let trusted = certdb.isCertTrusted(cert, Ci.nsIX509Cert.CA_CERT, Ci.nsIX509CertDB.TRUSTED_SSL);
-  certlist.push({name: cert.commonName, pem: pem, trusted: trusted});
-  if (trusted) {
-    certstring+=pem;
-  }
-}
-
-function save(path) {
-  // https://developer.mozilla.org/en-US/Add-ons/Code_snippets/File_I_O
-  Components.utils.import("resource://gre/modules/FileUtils.jsm");
-  var file = new FileUtils.File(path);
-  Components.utils.import("resource://gre/modules/NetUtil.jsm");
-
-  // file is nsIFile, data is a string
-
-  // You can also optionally pass a flags parameter here. It defaults to
-  // FileUtils.MODE_WRONLY | FileUtils.MODE_CREATE | FileUtils.MODE_TRUNCATE;
-  var ostream = FileUtils.openSafeFileOutputStream(file);
-
-  var converter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"].
-                  createInstance(Components.interfaces.nsIScriptableUnicodeConverter);
-  converter.charset = "UTF-8";
-  var istream = converter.convertToInputStream(certstring);
-
-  // The last argument (the callback) is optional.
-  NetUtil.asyncCopy(istream, ostream, function(status) {
-    if (!Components.isSuccessCode(status)) {
-      // Handle error!
-      return;
-    }
-
-    // Data has been written to the file.
-  });
-}

etc/cert_generator.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-# https://wiki.mozilla.org/CA/Included_Certificates
-# 1. Mozilla's official CA database CSV file is downloaded with curl
-#    and processed with awk.
-# 2. Rows end with `"\n`.
-# 3. Each row is split by ^" and "," into columns.
-# 4. Single and double quotes are removed from column 32.
-# 5. If column 13 (12 in the csv file) contains `Websites`
-#    (some are Email-only), column 32 is printed, the raw certificate.
-# 6. All CA certs trusted for Websites are stored into the `certs` file.
-
-url="https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReportPEMCSV"
-curl "${url}" -sSf | gawk -v RS="\"\n" -F'","|^"' \
-'{gsub("\047","",$(32));gsub("\"","",$(32));if($(13)~/Websites/)print $(32)}' \
-> ../resources/certs