Allow setting certificate path in pkl settings

I'm using pkl in an environment that uses custom certificates for communicating with a private repo with some pkl modules. For now, I've been copying the custom certificates from the system certificate store to `~/.pkl/cacerts` but this is annoying because the certificates have relatively short expiration times. Would it be possible to add an option to the `pkl:settings` module that allows you to set a static certificate path that is not `~/.pkl/cacerts`? I would like to do something like this:
```pkl
amends "pkl:settings"

cacerts = "/etc/ssl/certs/"
```

Start at the pkl:settings module and trace how the default ~/.pkl/cacerts location is selected. Confirm the new setting can point to a static certificate directory, then verify communication with a private repository using custom certificates.

Written by the indexing model from the issue text.