bundle letsencrypt root certificates

as per https://letsencrypt.org/2023/07/10/cross-sign-expiration.html
Letsencrypt is dropping support for Android <= 7 by removing cross signing.

to keep supporting older Android versions we need to bundle the root cert
ourselves. (Firefox for example does this too)

The KeyStore file is in BKS-V1 format. A good tools to edit the file is

https://keystore-explorer.org/

To keep the attack and bug surface as low as possible we only run the check
against the bundled keystore on Android <= 7