Function webpki_root_store 

pub fn webpki_root_store() -> RootCertStore

The Mozilla (webpki) public root set as a rustls RootCertStore: the DEFAULT trust for every outbound https dial — upstream connectors, active health probes, and the JWKS fetcher (#121 made the per-entity override configurable; this remains what an entity without a trusted_ca_file verifies against). Lives here, next to the other root-store machinery, so all outbound callers share one definition instead of each rebuilding it inline.