src: fix missing extra ca in tls.rootCertificates

[ebickle]

Fixes tls.rootCertificates missing certificates loaded from NODE_EXTRA_CA_CERTS.

Fixes: #32074

Potentially contains a semver-major breaking change. Change adheres to all existing specifications, but there is a non-zero risk that callers may have written code that does not expect changes to the contents of the tls.rootCertificates array.

• tls.rootCertificates now includes certificate loaded from NODE_EXTRA_CA_CERTS environment variable.
• each PEM string in tls.rootCertificates is now terminated with a \n line break. This adheres to the PEM file format specification and is generally preferred - many non node.js systems fail if the line-break is not specified.

Notes for code reviewers:

• OpenSSL writes PEM strings with a trailing newline. Keeping the trailing newline reduces code complexity and allows multiple certificates to be easily concatenated into a single PEM file.
• Certificates are read directly from the root X509_STORE* to ensure that tls.rootCertificates reflects the true certificates used by SecureContext and to avoid synchronizing/maintaining a separate variable in node_crypto.cc.
• The new X509ToPEM function was placed in node_crypto_common.cc since it pairs with the existing X509ToObject function.
• The GetRootCertificates function returns without setting a JavaScript return value when an unexpected error occurs (e.g. error calling PEM_write_bio_X509). This was done to remain consistent with the previous implementation of GetRootCertificates.

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[addaleax]

@nodejs/crypto

[sam-github]

Seems reasonable to me.

I don't think that adding a NL to the PEM is semver-major, particularly since PEM tooling is robust to extra NLs. In other words if people used to be adding a NL while concatenation certs and were getting "END X -----\n-----BEGIN ..." between certs and now get "END X -----\n\n-----BEGIN ...", IMO, the output is still within spec.

All bug fixes have a non-zero chance of breaking code which depends on implementation details.

[ebickle]

Looks as though all of the node ASAN builds were failing across the node.js ecosystem when this PR was submitted. Doesn't appear to be related to this PR.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/29663/

[addaleax]

Landed in 091444a