Update sorcery CA bundle

[anaumov]

I faced with SLL issue on VK auth. An issue described here #125. I found that CA bundle was updated 6 years ago. Here a new one. I downloaded it from https://curl.haxx.se/docs/caextract.html. Let me know if you have any questions.

[anaumov]

@athix can you take a look?

[joshbuker]

Updating the certificate authorities sounds like a high-risk change, so I'm hesitant to merge this without thoroughly validating the new list. If you have resources to help validate the authenticity, I can get this in sooner. Otherwise it will have to wait until I have time to look further into the issue.

Sorry for the inconvenience! In the short-term, you should be able to point your project at your fork with the ca changes.

[anaumov]

@athix Not sure how to validate it automatically. Will take a look and get back.

[joshbuker]

Hi @anaumov, any luck?

[anaumov]

@athix will get back to this PR next week. Sorry for the delay.

[anaumov]

I did research about this PEM file. It made by the tool mk-ca-bundle from creators of the curl. It downloads a file with all authorized providers from Mozilla. Then it converts a file to PEM format. That's it.

I looks ok to me to use the tool from creators of curl and Mozilla CA data. What do you think, @athix?

Resources:
Mozzila certificate store
Mozzila certdata file
mk-ca-bundle man page
mk-ca-bundle source code

[joshbuker]

@anaumov I'll look into implementing this in the v1 rework, although it may become obsolete if we move the provider system to use omniauth instead of directly calling oauth2.