This fix contains two parts:
  * initialize NSS in the CMIS UCP right before sending an HTTP request
    in case internal curl is used. This makes internal curl find the NSS
    CACERT database from the user mozilla profile.

  * add nsspem to allow curl to use CACERTs from libnssckbi. Without
    libnsspem curl is unable to read the certificates from the NSS
    database. The nss-pem code has been extracted from the fedora-hosted
    repository: https://git.fedorahosted.org/cgit/nss-pem.git

Change-Id: Ie8dedf020480cca01bf9761382886566a1150778