Improve CA bundle handling for libphutil / HTTPSFuture

Summary: On (some?) Windows systems and some non-Windows systems, cURL doesn't
have a builtin CA bundle. Provide some reasonable mechanisms to give cURL a
valid CA bundle.

Test Plan: I was only able to test this partially because I don't have a
self-signed keypair handy or really know how to generate one. @s and @koolvin,
you both reported issues with this -- can you let me know if this patch
addresses them? In the self-signing case, you'll need to create a "custom.pem"
file with your CA public key (I guess?) in it, perhaps by copying "default.pem"
and then appending it.

Reviewers: Koolvin, s, btrahan

Reviewed By: Koolvin

CC: aran, epriestley, jungejason

Maniphest Tasks: T537

Differential Revision: https://secure.phabricator.com/D1629