Bazel does not honor custom CA certificates

### Description of the problem:

When I try to use Bazel in an environment with TLS only working with custom CA certificates, it does not work (e.g. download dependencies).

One of the errors is:

```
ERROR: An error occurred during the fetch of repository 'zlib':
java.io.IOException: Error downloading [https://zlib.net/zlib-1.2.11.tar.gz] to /home/abergmei/.cache/bazel/_bazel_user/a05519119102d261558210037d2dc4c6/external/zlib/zlib-1.2.11.tar.gz: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```

### Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Have a non-rooted CA, which intercepts all HTTPS calls in your network.

### What operating system are you running Bazel on?

Ubuntu 18.04

### What's the output of `bazel info release`?

`release 1.2.1`

### Have you found anything relevant by searching the web?

### Any other information, logs, or outputs that you want to share?

Tried executing via `JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64 bazelisk build --host_javabase '@local_jdk//:jdk' //mytarget` but the error persists. Not sure though, that it really uses my local JDK.

Is there any way of forcing the bundled JDK to use a certs database outside of Bazel?

Reproduce the dependency-fetch failure using the provided Ubuntu 18.04 setup and bazelisk build invocation, then trace how Bazel selects and uses its bundled or local JDK. Done means HTTPS dependency downloads succeed when the environment relies on a custom CA certificate.

Written by the indexing model from the issue text.