Update certifi and replace complex certifi patch with a more targetted requests patch

[pradyunsg]

Toward #11500

[pfmoore]

So if I'm understanding this, it splits the existing patch into two parts:

1. A simple patch to certifi that does the vendoring
2. A patch to requests that doesn't use certifi.where if _PIP_STANDALONE_CERT is set.

+1 on this simplification, although I'd mildly prefer it to be a separate PR from the one that vendors certifi. In the interests of not making extra work just before the release, I'm happy to ignore that, though.

There's a test fix needed, because something is "normalising" a version component from "09" to "9".

[pfmoore]

The 22.3 release is due today. @pradyunsg do you expect to try to get this into 22.3, or should we defer it to 23.0?

[pradyunsg]

I'd mildly prefer it to be a separate PR from the one that vendors certifi.

They’re separate commits, and there’s a dependency between the two (the exact shape of the certifi patch varies based on whether we use it or requests to implement the default certificate path).

——-

I’ve made the edit for fixing the version problem — assuming that the CI is happy, we can land this. I’d like to see this in 22.3, since there’s been a certificate change. :)