Pass CA and client TLS certificates to build subprocesses

[ichard26]

The _PIP_STANDALONE_CERT environment variable hack is no longer required as pip doesn't run a zip archive of itself to provision build dependencies these days (which due to a CPython bug would leave behind temporary certifi files).

Fixes #5502.

[ichard26]

Thanks for the fast reviews folks!

[ichard26]

@jle-pass @AtomBaf given you seem interested in this bugfix, are you interested in testing out this change? It'd be helpful in ensuring that A) it works, and B) it doesn't break in whatever weird enterprise TLS setups that exist in the wild. You can install pip from this branch using pip install https://github.com/ichard26/pip/archive/pass-certs-down.zip.

Thanks!

[ichard26]

So apparently people depend on this private environment variable. Given we prefixed it with an underscore, I don't have any problems with breaking such individuals (especially since truststore is enabled by default) but heads up that we may get some bug reports on this.

[ichard26]

It's been one week (and one work week) since my call to action for community testing. Given the lack of any response, I am merging this as-is (with a minor tweak to the news entry to call out the envvar removal).