[19.1] Bump cacerts to 2026-10-20

What does this MR do and why?

Backports the cacerts bump to 2026.10.20 to 19-1-stable, cherry-picked from !9953 (merged). The 2026.10.20 CA bundle drops the compromised eMudhra/emSign intermediate roots distrusted in Mozilla NSS 3.131.1 (emSign Root CA - C1, emSign ECC Root CA - C3, emSign ECC Root CA - G3). This branch currently ships 2025.11.04, which still trusts them. The cherry-pick is clean: the version string, the sha256, and a rename of the license-patch directory.

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/work_items/10161+s

Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
• This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

• Refer to the patch release runbook for engineers and maintainers for guidance.
• Ask questions on the #releases Slack channel (internal only).