V4.x backport 12402 and 13279

Backport #12402 and #13279

@bnoordhuis PTAL

@MylesBorins @nodejs/lts Note that these basically land clean but a perl script needs to be run to clean up a header, the process is:

1. pick the certdata.txt commit (it lands clean)
2. pick the update root certificates commit - it conflicts on src/node_root_certs.h which is a header file that is auto-generated from certdata.txt
3. run ./tools/mk-ca-bundle.pl to regenerate the header file
4. git add src/node_root_certs.h, and git pick --continue

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• documentation is changed or added
• commit message follows commit guidelines

Affected core subsystem(s)