added ca-bundle target to main makefile;

for now this does rename the existing ca-bundle.crt to ca-bundle.crt.old;
maybe we can remove this once we are 100% sure that the new script works properly, and just overwrite the shipping one?