Support Chromium's new NSS DB path on Linux (default since M146)

## Summary

On Linux, since Chromium M146, the default NSS shared-DB location moved from `~/.pki/nssdb` to `~/.local/share/pki/nssdb`. mkcert only searches the old locations, so when a modern Chromium creates its DB at the new path and there's no legacy `~/.pki/nssdb`, `mkcert -install` finds no browser NSS DB and silently skips the Chrome/Chromium trust store. Chrome then rejects mkcert-issued certs with `ERR_CERT_AUTHORITY_INVALID`.

An environment that previously ran a pre-M146 Chromium already has a `~/.pki/nssdb`, so Chromium keeps using it and the problem stays masked. Environments built from scratch such as CI, and use M146+ Chromium, don't have the old `~/.pki/nssdb` and hit the failure.

Reference (Chromium docs):

> Since M146, Chromium defaults to `$HOME/.local/share/pki/nssdb` for the NSS Shared DB. If you still have an existing `$HOME/.pki/nssdb` database, Chromium will use that instead.

https://chromium.googlesource.com/chromium/src/+/main/docs/linux/cert_management.md

## Details

mkcert doesn't recognize the new location, so `mkcert -install` doesn't add the CA there.

## Environment

- Linux, Chromium >= 147 (e.g. bundled by Playwright 1.59+, which jumped 145 -> 147)
- Fresh CI environment (clean install every run)
- mkcert v1.4.4

## Workaround

Until mkcert searches the new path, create the legacy DB before installing. Chromium uses `~/.pki/nssdb` when it exists (per the doc above), and mkcert then has a DB to install the CA into:

```sh
mkdir -p "$HOME/.pki/nssdb"
certutil -d "sql:$HOME/.pki/nssdb" -N --empty-password
mkcert -install
```

Start at the mkcert -install entry point that discovers browser NSS databases on Linux, then compare its current locations with Chromium's documented post-M146 path. Done means a fresh Chromium M146+ environment receives the mkcert CA in the new NSS database; verify the relevant Linux installation behavior and preserve support for the legacy location.

Written by the indexing model from the issue text.