crypto/x509: TestHybridPool failures on Windows with `x509: certificate signed by unknown authority`

[bcmills]

--- FAIL: TestHybridPool (15.02s)
    hybrid_pool_test.go:66: verification failed for google.com chain (empty pool): x509: certificate signed by unknown authority
FAIL
FAIL	crypto/x509	31.546s

greplogs --dashboard -md -l -e 'FAIL: TestHybridPool'

2022-03-10T16:06:29-1cf6770/windows-amd64-longtest

(attn @golang/security for triage)

[bcmills]

greplogs --dashboard -md -l -e 'FAIL: TestHybridPool' --since=2022-03-11

2022-03-24T17:50:47-b95d332/windows-amd64-longtest

[gopherbot]

Change https://go.dev/cl/397694 mentions this issue: crypto/x509: local platform verifier tests on trybots

[bcmills]

greplogs --dashboard -md -l -e 'FAIL: TestHybridPool' --since=2022-03-25
2022-05-12T04:47:29-2bea43b/windows-amd64-longtest
2022-05-12T04:08:07-900ae5b/windows-amd64-longtest
2022-05-11T23:39:27-ec5bdef/windows-amd64-longtest
2022-05-11T20:11:34-c1105cf/windows-amd64-longtest
2022-05-11T15:00:05-d339d08/windows-amd64-longtest
2022-05-11T13:55:35-de9805c/windows-amd64-longtest
2022-05-11T08:12:15-7b314d2/windows-amd64-longtest
2022-05-10T22:12:11-6fd0520/windows-amd64-longtest

[gopherbot]

Change https://go.dev/cl/405914 mentions this issue: crypto/x509: attempt to prime windows root pool before hybrid test

[bcmills]

Due to #52591 the windows-amd64-longtest builders have only completed one run since the above CL went in, but so far they haven't failed with this mode again.

Marking WaitingForInfo to remind us to recheck the fix after more test runs have completed.

[bcmills]

There was a rash of failures yesterday — again all on Windows — but the failure mode is slightly different. 🤔

--- FAIL: TestPlatformVerifier (0.08s)
    --- FAIL: TestPlatformVerifier/wrong_host_for_leaf (0.02s)
        root_windows_test.go:109: unexpected verification error: got "x509: certificate has expired or is not yet valid: ", want "x509: certificate is valid for *.badssl.com, badssl.com, not wrong.host.badssl.com"
FAIL
FAIL	crypto/x509	1.942s

greplogs -l -e 'FAIL: TestPlatformVerifier .*(?:\n[ ]{4}.*)*badssl\.com' --since=2022-05-13
2022-05-17T18:55:46-668041e/windows-amd64-longtest
2022-05-17T18:19:34-076039a/windows-amd64-longtest
2022-05-17T18:13:13-afd181c/windows-amd64-longtest
2022-05-17T17:54:33-cc4957a/windows-amd64-longtest
2022-05-17T17:29:34-cf5fa2b/windows-amd64-longtest
2022-05-17T16:09:37-770e0e5/windows-amd64-longtest
2022-05-17T14:39:18-cf7ec0f/windows-amd64-longtest