Backport removal of 1024-bit root certificates to older branches

[johnbillion]

In [61669] (#64063) the legacy 1024-bit root certificates were removed from ca-bundle.crt. The older branches still include them.

These certs were only kept for OpenSSL 1.0.1e to 1.0.1q, which had path discovery bugs (see #34935). Those versions are over a decade old.

6.8 and 6.9

These branches build the bundle with Grunt. The backport is:

• Apply the Gruntfile.js change from [61669]
• Delete wp-includes/certificates/cacert.pem and wp-includes/certificates/legacy-1024bit.pem
• Regenerate ca-bundle.crt

4.7 to 6.7

These branches have no Grunt task for certs, ca-bundle.crt is maintained directly. The backport is to copy over trunk's ca-bundle.crt.

Backports r61669 to the 6.8 branch: applies the Gruntfile.js change, deletes cacert.pem and legacy-1024bit.pem, and regenerates ca-bundle.crt with npm run grunt build:certificates. The resulting ca-bundle.crt is identical to trunk's.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Applying the backport, regenerating the bundle, and verifying the result; reviewed by me.

Backports r61669 to the 6.9 branch: applies the Gruntfile.js change, deletes cacert.pem and legacy-1024bit.pem, and regenerates ca-bundle.crt with npm run grunt build:certificates. The resulting ca-bundle.crt is identical to trunk's.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Applying the backport, regenerating the bundle, and verifying the result; reviewed by me.