master: update deps and set version to 3.12.0-alpha (#548)

* chore: update all workflows to use go1.17.2

See https://github.com/ooni/probe/issues/1815

* chore: update all dependencies

See https://github.com/ooni/probe/issues/1815

* chore: run `go generate`

See https://github.com/ooni/probe/issues/1815

* chore: update the user-agent

Part of https://github.com/ooni/probe/issues/1815

* Set version to 3.12.0-alpha

Part of https://github.com/ooni/probe/issues/1815

* fix: update to ooni/probe-assets@v0.5.0

This overcomes https://github.com/ooni/probe/issues/1836 in the CLI and,
while there, let us also make maxminddb tests stricter.

* fix(QA/Dockerfile): build using go1.17

See https://github.com/ooni/probe-cli/pull/547#issuecomment-947760839

* chore(mk): use go1.17.2

Part of https://github.com/ooni/probe/issues/1815

* fix(codeql): always run for master

Otherwise we see a warning that there is no CodeQL information
available for the base branch and this is sub-optimal.

Part of https://github.com/ooni/probe/issues/1815

internal/netxlite/certifi.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// 2021-09-29 16:40:31.464953 +0200 CEST m=+0.466236210
+// 2021-10-20 14:12:54.599493 +0200 CEST m=+0.419755751
 // https://curl.haxx.se/ca/cacert.pem
 
 package netxlite
@@ -10,7 +10,7 @@ const pemcerts string = `
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla as of: Mon Jul  5 21:35:54 2021 GMT
+## Certificate data from Mozilla as of: Thu Sep 30 03:12:05 2021 GMT
 ##
 ## This is a bundle of X.509 certificates of public Certificate Authorities
 ## (CA). These were automatically extracted from Mozilla's root certificates
@@ -390,26 +390,6 @@ mNEVX58Svnw2Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
 vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep+OkuE6N36B9K
 -----END CERTIFICATE-----
 
-DST Root CA X3
-==============
------BEGIN CERTIFICATE-----
-MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/MSQwIgYDVQQK
-ExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4X
-DTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVowPzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1
-cmUgVHJ1c3QgQ28uMRcwFQYDVQQDEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmT
-rE4Orz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEqOLl5CjH9
-UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9bxiqKqy69cK3FCxolkHRy
-xXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40d
-utolucbY38EVAjqr2m7xPi71XAicPNaDaeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0T
-AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQ
-MA0GCSqGSIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69ikug
-dB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXrAvHRAosZy5Q6XkjE
-GB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZzR8srzJmwN0jP41ZL9c8PDHIyh8bw
-RLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubS
-fZGL+T0yjWW06XyxV3bqxbYoOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
------END CERTIFICATE-----
-
 SwissSign Gold CA - G2
 ======================
 -----BEGIN CERTIFICATE-----