extensionSystem: Use the system cert list

libsoup won't check for a valid cert by default, so copy some logic from
glib-networking to check against the system cert list. Additionally, allow a
fallback for developers, ~/.local/share/extensions.gnome.org.crt, for easy
local development of the website.

https://bugzilla.gnome.org/show_bug.cgi?id=658870

js/ui/extensionSystem.js

@@ -44,6 +44,16 @@ const _httpSession = new Soup.SessionAsync();
 if (Soup.Session.prototype.add_feature != null)
     Soup.Session.prototype.add_feature.call(_httpSession, new Soup.ProxyResolverDefault());
 
+function _getCertFile() {
+    let localCert = GLib.build_filenamev([global.userdatadir, 'extensions.gnome.org.crt']);
+    if (GLib.file_test(localCert, GLib.FileTest.EXISTS))
+        return localCert;
+    else
+        return Config.SHELL_SYSTEM_CA_FILE;
+}
+
+_httpSession.ssl_ca_file = _getCertFile();
+
 // Maps uuid -> metadata object
 const extensionMeta = {};
 // Maps uuid -> importer object (extension directory tree)