ca-certs: generate install artifacts and improve certdata/trust-store compatibility

- stop committing generated man/completion files in contrib/
- generate man page and shell completions during Meson install via install-generated-docs.sh
- switch reqwest to native-tls and add Mozilla hg bootstrap certs with openssl fallback fetch
- make certdata sync use a temporary auto-cleaned workspace by default
- add BLFS/make-ca compatibility outputs and symlinks under /etc/pki and /etc/ssl
- validate extracted outputs are non-empty and add tests for temp sync output behavior

scripts/install-generated-docs.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+set -eu
+
+bin="$1"
+mandir_opt="$2"
+datadir_opt="$3"
+
+resolve_dir() {
+    case "$1" in
+        /*) printf '%s%s\n' "${DESTDIR:-}" "$1" ;;
+        *) printf '%s/%s\n' "${MESON_INSTALL_DESTDIR_PREFIX:?}" "$1" ;;
+    esac
+}
+
+man_root="$(resolve_dir "$mandir_opt")"
+data_root="$(resolve_dir "$datadir_opt")"
+tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/ca-certs-docs.XXXXXX")"
+
+cleanup() {
+    rm -rf "$tmp_dir"
+}
+trap cleanup EXIT INT TERM
+
+"$bin" gen-artifacts --out-dir "$tmp_dir"
+
+install -Dm644 "$tmp_dir/ca-certs.8" \
+    "$man_root/man8/ca-certs.8"
+install -Dm644 "$tmp_dir/completions/ca-certs.bash" \
+    "$data_root/bash-completion/completions/ca-certs"
+install -Dm644 "$tmp_dir/completions/ca-certs.fish" \
+    "$data_root/fish/vendor_completions.d/ca-certs.fish"
+install -Dm644 "$tmp_dir/completions/_ca-certs" \
+    "$data_root/zsh/site-functions/_ca-certs"