Bundle root certificates at compile time

[tpoliaw]

In order to make https connections for authorisation, the reqwuest
library needs root certificates. In the minimal container used, these
are not present in the OS so authorisation fails. By bundling them at
compile time (via the webpki-roots crate) the native certificates are
not required.

This usually presents a maintenance burden as the application needs to
be recompiled if root CA certificates change, however in the case where
the application is running in a container, the container would need to
be rebuilt in either case to include the new certificates.

[garryod]

Seems reasonable to me - it's what I do for most of my services. My only suggestion would be setting up dependabot to automate the updates though this is a bit tricky if the upgraded dependency is only in the Cargo.lock

[tpoliaw]

Thanks, I'll look into setting up dependabot in a separate change.

this is a bit tricky if the upgraded dependency is only in the Cargo.lock

Tricky but doable/copyable?

[garryod]

Thanks, I'll look into setting up dependabot in a separate change.

this is a bit tricky if the upgraded dependency is only in the Cargo.lock

Tricky but doable/copyable?

Looks like you can set the dependabot dependency-type to indirect. Might be noisy though