certified-update broken by Ruby 3.0

[cabo]

https://bugs.ruby-lang.org/issues/15893 deprecated (and finally removed in Ruby 3.0) the extension to Kernel.open by open-uri.

This breaks line 13 of certified-update.

A maximally backward compatible fix is:

-open(CERT_BUNDLE_URL) do |remote_file|
+URI(CERT_BUNDLE_URL).open do |remote_file|