Pass private CA certificates as PEM bytes

add_root_certificate now takes the PEM bytes and returns a Result. It accepts a bundle, so a root and its intermediates can be passed together.

• Changed add_root_certificate to take PEM bytes; certificates added through it are now applied to the trust store
• Added the bundled certificate authorities alongside the system trust store, so a container without a system certificate bundle keeps connecting
• Added a connect timeout to attachment transfers