src: make root_certs const

Make the root_certs global fully const.  As a side effect, that moves it
from the .data section to the .rodata section.  Makes it a little easier
to reason about the remaining globals.