fix(cert): install MITM CA into LibreWolf NSS stores

[dazzling-no-more]

Problem

Issue #1145: LibreWolf users get MOZILLA_PKIX_ERROR_MITM_DETECTED when visiting HSTS-protected sites (bing.com, youtube.com, ...) through MasterHttpRelayVPN's MITM mode. HSTS gives no "Add Exception" affordance, so the user is fully locked out of those sites despite the OS-level CA install having succeeded.

Root cause: cert_installer.rs only scanned Firefox profile roots (~/.mozilla/firefox, the snap variant, %APPDATA%\Mozilla\Firefox\Profiles, ~/Library/Application Support/Firefox/Profiles). LibreWolf is a Firefox fork with strict privacy defaults; it shares Firefox's NSS DB layout and respects the same security.enterprise_roots.enabled pref, but stores its profile tree under its own app dir. Neither the per-profile certutil -A install nor the user.js enterprise-roots auto-trust fallback ever touched LibreWolf, so the browser never trusted our CA.

Same failure mode behind already-closed #955 and #959 (Firefox-fork users reporting the identical "secure connection could not be established" symptom).

Fix

Extend Mozilla-family profile discovery to cover LibreWolf on every supported platform. No behavioural change for Firefox installs.

Changes in src/cert_installer.rs

• Renamed firefox_profile_dirs() → mozilla_family_profile_dirs(). Same flat-vec return type so all five call sites read identically; the rename is signposting only.
• Extracted mozilla_family_profile_roots(os, home, appdata, xdg_config_home): pure helper returning the per-OS root list. Takes env values as args so unit tests pin the layout without env mutation or filesystem touches.
• Extracted discover_profile_dirs(roots): pure FS-walker that filters each root's children to those containing cert9.db (NSS sql:) or cert8.db (legacy dbm:). Splitting it out lets a tempdir test cover the filter directly instead of indirectly through env-coupled callers.
• Added LibreWolf roots:
  • macOS: ~/Library/Application Support/LibreWolf/Profiles
  • Windows: %APPDATA%\LibreWolf\Profiles
  • Linux: four layouts, because LibreWolf migrated mid-project:
    • ~/.librewolf — legacy Firefox-style layout, still present on older installs.
    • ${XDG_CONFIG_HOME:-~/.config}/librewolf/librewolf — current XDG layout (empty XDG_CONFIG_HOME is treated as unset per the XDG Base Directory spec).
    • Both of the above again under ~/.var/app/io.gitlab.librewolf-community/ for the Flatpak sandbox, which redirects HOME inside the container.
• Renamed enable_firefox_enterprise_roots → enable_mozilla_enterprise_roots (and disable_* likewise), since the pref now gets written for LibreWolf profiles too. Three internal log strings (firefox profile {} ...) updated to mozilla profile {} so debug output reflects the broader scope.
• User-facing log updates in 4 paths (NSS install warn, certutil-missing debug, removal warn, partial-cleanup warn) now mention Firefox/LibreWolf/Chrome instead of Firefox/Chrome, so LibreWolf users see actionable guidance when something needs manual cleanup.

Non-changes (deliberate)

• Floorp / Waterfox / Mullvad Browser — same Firefox-fork pattern, same fix shape, but no open issues from those user populations. Held off to keep this PR scoped to the reproducible bug. Easy follow-up if/when reported.
• macOS ~/.librewolf and Windows %USERPROFILE%\.librewolf — both appear in the LibreWolf docs but only as librewolf.overrides.cfg (the autoconfig file) locations, not as profile-data locations containing cert9.db. Including them would mean scanning paths we have no evidence are profile roots. If users report MITM_DETECTED on those layouts, a one-line addition + test covers it.

Test plan

• cargo test --lib — 239 passing (was 236 pre-patch + 8 new in cert_installer).
• cargo build — clean.
• rustfmt --check src/cert_installer.rs — clean.
• New unit tests pin every supported layout — Linux (firefox + snap + librewolf legacy + XDG default + XDG override + Flatpak ×2), macOS, Windows, plus edge cases (empty XDG_CONFIG_HOME falls back to default; missing %APPDATA% no-ops; unknown OS yields empty).
• New tempdir test for discover_profile_dirs constructs abc.default/cert9.db, legacy.profile/cert8.db, a sibling dir without a DB, and a stray profiles.ini file plus a non-existent root — asserts only the two real profiles come back.
• Manual repro on a Linux box with LibreWolf installed: install CA via mhrv-rs-ui, restart LibreWolf, visit https://bing.com — expect the page to load instead of MOZILLA_PKIX_ERROR_MITM_DETECTED. (Recommend issue reporter @persiansunny re-run the original repro from bing any popular site #1145 to confirm.)

Closes #1145. Likely also addresses #955 and #959 (same root cause class), though those users would need to confirm.

[BuffOvrFlw]

Would you also please add support for GNU IceCat?
the directory is:
~/.mozilla/icecat/

[dazzling-no-more]

the directory is:
~/.mozilla/icecat/

Done, please test and report back.