linux_amd64_longtest fails: unable to access 'https://vcs-test.golang.org/git/gitrepo1/': server certificate verification failed.

This shows up in build logs (https://dev.azure.com/dnceng/internal/_build/results?buildId=1451186&view=logs&j=063c65e0-9120-54dd-9d62-ab0783e0d207&t=eaf910ee-30a3-5737-d12a-bec92dcf10b6&l=574):

FAIL
FAIL	cmd/go/internal/modfetch	156.045s
2021/11/02 21:59:53 git clone --mirror https://vcs-test.golang.org/git/gitrepo1 /tmp/gitrepo-test-3917403346/gitrepo2 in : exit status 128:
	Cloning into bare repository '/tmp/gitrepo-test-3917403346/gitrepo2'...
	fatal: unable to access 'https://vcs-test.golang.org/git/gitrepo1/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
FAIL	cmd/go/internal/modfetch/codehost	0.347s
ok  	cmd/go/internal/modfetch/zip_sum_test	0.034s
FAIL
FAIL	cmd/go/internal/modload	277.614s

The container we're using is old, and is missing updates to make the cert work. We need to upgrade, then e.g. git clone https://vcs-test.golang.org/git/gitrepo1/ will work:
mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04-20210223192210-047508b ->
mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04-20211022152710-047508b

This gets a newer version of ca-certificates.

• May be related to https://github.com/microsoft/go/issues/254

Start with the linux_amd64_longtest build configuration and find where it selects the mcr.microsoft.com/dotnet-buildtools/prereqs Ubuntu image. Verify the image reference and run the affected long test or reproduce the git clone; done means the certificate verification succeeds and cmd/go/internal/modfetch and cmd/go/internal/modload pass.