travis: remove expired DST Root CA X3 cert on trusty

[dgw]

Description

Forcibly remove the expired mozilla/DST_Root_CA_X3.crt file and update CA certificate bundle, only on Trusty distro (used for Python 3.3 tests). Also ignore certifi trust store on trusty+py3.3, since certifi maintainers are stubborn (see comments in diff).

Thanks to @half-duplex for helping with the monkey-patch step!

Checklist

• I have read CONTRIBUTING.md
• I can and do license this contribution under the EFLv2
• No issues are reported by make qa (runs make quality and make test)
• I have tested the functionality of the things this change touches
  • Painstakingly: both myself and @half-duplex ran tests in local VMs, and I pushed promising solutions to a travis- prefixed test branch to see how they performed on the real thing.
  • If this PR build fails despite all of our advance testing, I might actually cry.

Notes

Blocks #2190, which can't pass its CI tests until this is fixed.

Considering an alternative approach that replaces the cp with an environment variable (REQUESTS_CA_BUNDLE).

[half-duplex]

Nits, these and REQUESTS_CA_BUNDLE= are cleaner (and severable) but should be functionally identical and this patch dies with 7.x so 🤷

Other thoughts:

• If anyone is actually using 3.3 in a venv they'll probably have this problem, if we care about fully supporting 3.3 (I don't) it should be documented.
• Why doesn't this affect newer python? My py3.9 also uses certifi's store in a venv, but works fine... openssl version?
• Nobody should be using python 3.3 anyway: I am not aware of any supported distro/release without 3.4+ available

[dgw]

I applied the suggestions locally to update the comments all in one step and minimize Travis build time.

• Why doesn't this affect newer python? My py3.9 also uses certifi's store in a venv, but works fine... openssl version?

Probably this, yes.