refactor(netxlite): restructure dialer tests (#486)

While there, add one more test checking for whether the internal
CA bundle we use can actually be loaded.

Part of https://github.com/ooni/probe/issues/1591

internal/netxlite/certifi_test.go

@@ -0,0 +1,13 @@
+package netxlite
+
+import (
+	"crypto/x509"
+	"testing"
+)
+
+func TestPEMCerts(t *testing.T) {
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM([]byte(pemcerts)) {
+		t.Fatal("cannot load pemcerts")
+	}
+}