Trusted root CAs

When the scanner validates a certificate chain, it trusts the root authorities listed below. The store is assembled from three sources: the operating-system store, the Node.js bundle (Mozilla CA list compiled into the runtime), and our own weekly CCADB/Mozilla TLS-root snapshot (data/ccadb-roots.pem, refreshed via scripts/update-ca-bundle.js). The snapshot keeps the store current even when the OS/Node bundle lags behind.

This list is generated live from the running server, so it reflects exactly what is trusted right now. Entries are deduplicated by certificate fingerprint.