Motivation for this change

This is a fix for the security vulnerability identified in #94722. See the ubuntu bug for some additional context.

This PR cherry-picks the patch from the upstream git repository.

This was validated as follows:

~> nix-shell -I nixpkgs=$HOME/git/nixpkgs -p busybox openssl

[nix-shell:~]$ busybox wget https://untrusted-root.badssl.com/
Connecting to untrusted-root.badssl.com (104.154.89.105:443)
wget: error getting response: Connection reset by peer

When this is run on the current master, it will instead download the file without any warnings.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.