Mozilla's root store changes land in NSS first and reach the Firefox
release branch, which mk-ca-bundle.pl reads by default, about a
release cycle later. The root changes NSS landed on 2026-07-14 reached
castore on 2026-08-13. Firefox covers that gap for its own users with
OneCRL and CRLite. Erlang :ssl doesn't check revocation by default, so
the bundle is the only protection castore users get.

This picks up the removal of emSign ECC Root CA - G3, emSign Root CA -
C1 and emSign ECC Root CA - C3 from NSS:
https://github.com/nss-dev/nss/commit/0a2b0c75fa036930d98331b721c0780693a3e17a
https://github.com/nss-dev/nss/commit/15734105a44679969114534ac5ceaf08e9630dd3

The private keys of eight eMudhra intermediate CAs were compromised
(https://emudhra.we-have-a-problem.com). Through the emSign Root TLS CA
- G3 cross-sign they chain to emSign ECC Root CA - G3, so Erlang :ssl
with castore 1.0.21 accepts servers using those intermediates.

Every entry also gains the SHA-256 fingerprint comment that
mk-ca-bundle.pl started emitting in version 1.34.

Closes https://github.com/elixir-mint/castore/issues/89