Pull up following revision(s) (requested by riastradh in ticket #350):

tests/usr.sbin/certctl/t_certctl.sh: revision 1.10
usr.sbin/certctl/certctl.sh: revision 1.5
tests/usr.sbin/certctl/t_certctl.sh: revision 1.9

certctl(8): Test permissions of ca-certificates.crt.

Inadvertently created 0600 instead of 0644 due to copying file
created by mktemp(1) with cp(1).

certctl(8): Fix permissions on ca-certificates.crt bundle: 0644.

While here, write it atomically: write to .tmp first, then rename
when done; this way applications never see a partially-written bundle
at /etc/openssl/certs/ca-certificates.crt.

(martin)