Add fork of Go 1.15-dev's crypto/x509

Snapshotted from Go commit 619c7a48a38b28b521591b490fd14ccb7ea5e821
(https://go-review.googlesource.com/c/go/+/229762,
"crypto/x509: add x509omitbundledroots build tag to not embed roots")

With 975c01342a25899962969833d8b2873dc8856a4f
(https://go-review.googlesource.com/c/go/+/220721) removed, because it
depends on other stuff in Go std that doesn't yet exist in a Go
release.

Also, add a subset fork of Go's internal/testenv, for use by x509's tests.

tempfork/x509/root_omit_test.go

@@ -0,0 +1,22 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build darwin,arm64,x509omitbundledroots
+
+package x509
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestOmitBundledRoots(t *testing.T) {
+	cp, err := loadSystemRoots()
+	if err == nil {
+		t.Fatalf("loadSystemRoots = (pool %p, error %v); want non-nil error", cp, err)
+	}
+	if !strings.Contains(err.Error(), "root bundling disabled") {
+		t.Errorf("unexpected error doesn't mention bundling: %v", err)
+	}
+}