Read System.keychain as well as SystemRootCertificates.keychain for MacOS CA Bundle

[dreilly1982]

This adds /Library/Keychains/System.keychain as a keychain to look for trusted CA certficates. Fixes #22700

[alexrp]

@FnControlOption would you mind reviewing this since you contributed #14325?

[FnControlOption]

Ran Certificate.Bundle test; seems to work as intended 👍

Amended the commit for a cleaner diff: FnControlOption@e2bbdee

[dreilly1982]

I appreciate you cleaning up the diff on that one, I didn't realize just how ugly that looked until the PR was already made. As far as CA Bundles on MacOS are concerned, I think it should eventually read off of any keychain the user has loaded, and I have code that can pull those, but that requires linking against the MacOS frameworks, and I'm not familiar enough with the zig build system (yet) to do that in this context, nor do I know if that is a good idea.

[squeek502]

Is it intentional that both keychain files are required after these changes (i.e. if either one can't be read, the function fails)?

Context: https://ziggit.dev/t/zig-fetch-failing-with-discover-remote-git-server-capabilities-certificatebundleloadfailure/8608

[schmee]

@squeek502 possibly related: #22870