security: distrust two Mozilla root CAs

Blacklist "Comodo AAA Services root" and "emSign ECC Root CA - G3"
so they are left out of /etc/ssl/certs/ca-certificates.crt.

Mozilla already distrusted the Comodo root for serverAuth (it was only
trusted for email), so emSign ECC G3 is the only root this removes for
TLS. Apps that ship their own trust store (NSS in browsers, certifi,
Java cacerts) are not affected.

Assisted-by: Claude:opus-5-5

modules/security.nix

@@ -45,6 +45,12 @@
     "net.ipv6.conf.default.accept_redirects" = 0;
   };
 
+  # Drop these roots from the system CA bundle (names must match bundle labels)
+  security.pki.caCertificateBlacklist = [
+    "Comodo AAA Services root"
+    "emSign ECC Root CA - G3"
+  ];
+
   # USBGuard configuration
   services.usbguard = {
     enable = false;