api: ignore HTTPS errors if minimum curl version isn't installed

[EricFromCanada]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

Similar to the situation addressed in #15895, a system with a built-in curl that's too old to handle some certificates (e.g. OS X 10.11) won't be able to fetch the dependencies for compiling a newer curl, which is run by update.sh as part of the initial install process. That's been partially resolved by #16079 which fixes mirror support, and this PR finishes the job by:

• in development_tools.rb, adding two functions to wrap the task of checking if the system CA certificates or curl need replacing; each just checks if they're a) too old and b) haven't been replaced yet. Also added is a function for generating the insecure download warning, called by api.rb and download_strategy.rb.
• in api.rb, setting the flag to use --insecure when fetching the API files if either the system CA certificates or curl need replacing. Both need to be checked because brew.sh is written to specify that either of them is too old, but not both.
• in resource.rb, modifying the line that allows the ca-certificates package to be downloaded with --insecure if either the system CA certificates or curl need replacing.

On a fresh OS X 10.11 system this results in a working installation.

[MikeMcQuaid]

Thanks @EricFromCanada! Some mild refactoring suggestions here.

[Bo98]

This shoudn't be necessary as we provide HTTP mirrors, and have audits demanding that. That'll explain how this used to work before.

However our mirror support was completely broken a few months back. I'll fix that.

[EricFromCanada]

That does help, but the api.rb changes are still needed because it needs to pass --insecure for downloading ca-certificates also if HOMEBREW_SYSTEM_CURL_TOO_OLD is set. I've updated the PR description accordingly.

[Bo98]

Ok, make sense. Thanks!

[MikeMcQuaid]

Thanks @EricFromCanada!