Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at
all - configure reports "ca cert bundle: no" - so every HTTPS request would
fail verification. Schannel used to read the machine's ROOT and CA stores on
its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the
Win32 crypto API.
Applied where the agent speaks HTTPS on Windows: the https_client transport,
and wurl_http_request, which is what agentd's uninstall check and the
github, office365 and ms-graph modules go through.
An explicitly configured still stands alone - the machine's stores are
not added on top of it, or the trust set would silently widen. Looking the
bundle up is also now skipped for plain HTTP, where it was never used.