overhaul ca-certificates-java
This fixes the long broken ca-certificates-java (certificate updates were not being properly applied, especially obsolete certificates were never removed. And it also gets rid of the nasty circular dependency by using triggers. This needs to go along with a ca-certificates update.