Update CA certificates to NSS 3.87

[benkard]

Fixes #356.

[benkard]

This is something of a kluge, but it was the best I could come up with given my lack of knowledge about Niv.

In my own testing I needed the following override in addition:

@@ -15,6 +15,9 @@ with import sources.nixpkgs
               sha256 = "sha256-aKGJRJbT0Vi6vHX4pd2j9Vt8FWBXOTbjsQGhD6SsFS0=";
             })
           { };
+
+      # Disable tests for Go because they fail for some reason.
+      go = super.go.overrideAttrs (superAttrs: { doCheck = false; });
     })
   ];
 };

I did not include it in the patch because it seemed out of place and I suspect an environment issue on my side.

I have successfully tested the result with my self-hosted GitLab.