fix(tls): merge SSL_CERT_FILE/DIR roots with configured certificates

[aoright]

Description

When users activate an environment shell (e.g. pixi shell), activation scripts (from OpenSSL or ca-certificates) set SSL_CERT_FILE and SSL_CERT_DIR pointing to the environment's certificates.

Previously, Certificates::for_mode in crates/pixi_utils/src/tls.rs returned early when from_env() was non-empty, completely discarding from_native_store() or webpki_roots(). This dropped corporate root CAs trusted by the operating system keychain / Windows certificate store when running inside an activated environment shell, leading to UnknownIssuer TLS certificate errors against corporate proxies and private repositories.

This change loads the base trust roots for the configured mode (System or Webpki) and merges certificates from SSL_CERT_FILE and SSL_CERT_DIR into them, deduplicating any duplicates. This matches the behavior of the native-tls backend (apply_native_tls_roots) and ensures custom/corporate certificates in both the OS store and the environment are trusted.

Fixes #6884

How Has This Been Tested?

• Added test_webpki_roots_non_empty verifying bundled Mozilla roots are loaded and non-empty.
• Added test_for_mode_without_env asserting System and Webpki modes load expected native and webpki roots when no env vars are present.
• Added test_for_mode_merges_ssl_cert_file_with_system verifying that custom PEM certificates from SSL_CERT_FILE are merged into system store roots without discarding native roots.
• Added test_for_mode_merges_ssl_cert_file_with_webpki verifying custom PEM certificates merge with webpki roots.
• Added test_merge_deduplicates verifying duplicate certificates are deduplicated cleanly.
• Verified all 80 tests in pixi_utils pass: cargo test -p pixi_utils.
• Verified cargo test -p pixi_config --lib.
• Ran cargo fmt --check and cargo clippy --package pixi_utils --package pixi_config --all-targets -- -D warnings.

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.
    Tools: Google Antigravity

Checklist:

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added sufficient tests to cover my changes.