Protect native Git HTTPS fetches and Nix generator downloads from compromised certificate authorities. Preserve configured Git certificate trust and authentication, and refresh build dependencies.
Native Git HTTPS proxies are temporarily unsupported. Direct HTTPS and HTTP CONNECT proxies remain supported.
Changes: #1132