This change should prevent old clients (e.g., Android 6) from failing to perform a ndt7 experiment because their internal CA bundle is now too old. Reference issue: https://github.com/ooni/probe/issues/2031 While there, run `go mod tidy` to fix a minor inconsistence in the current `go.mod` file. This diff WILL require a backport to release/3.14.