Add root store directory fallback on Linux/Unix.

[bartonjs]

When reading the root store directory for the first time, if
the read produced no data and the SSL_CERT_DIR environment
variable wasn't set, see if /etc/ssl/certs gives a different answer.

This change also changes the LastWriteTime model for caching
to not pin the symlink target on the first read, and support the
bundle file being a symlink (and the target being updated to
trigger refresh).

Fixes #38730.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

When reading the root store directory for the first time, if
the read produced no data and the SSL_CERT_DIR environment
variable wasn't set, see if /etc/ssl/certs gives a different answer.

This change also changes the LastWriteTime model for caching
to not pin the symlink target on the first read, and support the
bundle file being a symlink (and the target being updated to
trigger refresh).

Fixes #38730.

Author:	bartonjs
Assignees:	-
Labels:	area-System.Security
Milestone:	-

[GrabYourPitchforks]

Nit: Consider adding a comment to line 91 along the lines of "This is an unsynchronized access to the Elapsed property, which means we could observe a torn write. But the worst case is that there's a brief window where we miss the expiration notification. This is an acceptable risk."