Make libcurl respect the SSL_CERT_{DIR,FILE} variables by default. The variables
are fetched during initialization to preserve thread-safety (curl_global_init(3)
must be called when no other threads exist).

This fixes network functionality in rust:cargo, and probably removes the need
for other future workarounds.
===================================================================
Index: curl-8.19.0/lib/easy.c
===================================================================
--- curl-8.19.0.orig/lib/easy.c
+++ curl-8.19.0/lib/easy.c
@@ -117,6 +117,9 @@ curl_calloc_callback Curl_ccalloc = (cur
 static char *leakpointer;
 #endif
 
+char * Curl_ssl_cert_dir = NULL;
+char * Curl_ssl_cert_file = NULL;
+
 /**
  * curl_global_init() globally initializes curl given a bitwise set of the
  * different features of what to initialize.
@@ -140,6 +143,9 @@ static CURLcode global_init(long flags,
     goto fail;
   }
 
+  Curl_ssl_cert_dir = curl_getenv("SSL_CERT_DIR");
+  Curl_ssl_cert_file = curl_getenv("SSL_CERT_FILE");
+
   if(!Curl_ssl_init()) {
     DEBUGF(curl_mfprintf(stderr, "Error: Curl_ssl_init failed\n"));
     goto fail;
@@ -269,6 +275,9 @@ void curl_global_cleanup(void)
   Curl_ssl_cleanup();
   Curl_async_global_cleanup();
 
+  free(Curl_ssl_cert_dir);
+  free(Curl_ssl_cert_file);
+
 #ifdef _WIN32
   Curl_win32_cleanup(easy_init_flags);
 #endif
Index: curl-8.19.0/lib/vtls/vtls.c
===================================================================
--- curl-8.19.0.orig/lib/vtls/vtls.c
+++ curl-8.19.0/lib/vtls/vtls.c
@@ -294,10 +294,8 @@ static void free_primary_ssl_config(stru
 CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
 {
   struct ssl_config_data *sslc = &data->set.ssl;
-#if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
   struct UserDefined *set = &data->set;
   CURLcode result;
-#endif
 
   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
 #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
@@ -318,6 +316,21 @@ CURLcode Curl_ssl_easy_config_complete(s
         return result;
     }
 #endif
+    extern char * Curl_ssl_cert_dir;
+    extern char * Curl_ssl_cert_file;
+    if(Curl_ssl_cert_dir) {
+      if(result = Curl_setstropt(&set->str[STRING_SSL_CAPATH], Curl_ssl_cert_dir))
+        return result;
+      if(result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_PROXY], Curl_ssl_cert_dir))
+        return result;
+    }
+
+    if(Curl_ssl_cert_file) {
+      if(result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], Curl_ssl_cert_file))
+        return result;
+      if(result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_PROXY], Curl_ssl_cert_file))
+        return result;
+    }
   }
   sslc->primary.CAfile = data->set.str[STRING_SSL_CAFILE];
   sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];