optional ro mount /etc/pki in nsjail (#519)

contents of /etc/ssl symlink to /etc/pki on my system (Fedora) so some
programs (like pip) fail without /etc/pki

nsjail/download.config.proto

@@ -50,6 +50,13 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/etc/pki"
+    dst: "/etc/pki"
+    is_bind: true
+    mandatory: false
+}
+
 mount {
     src: "/etc/ca-certificates"
     dst: "/etc/ca-certificates"

nsjail/run.deno.config.proto

@@ -85,6 +85,13 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/etc/pki"
+    dst: "/etc/pki"
+    is_bind: true
+    mandatory: false
+}
+
 mount {
     src: "/etc/resolv.conf"
     dst: "/etc/resolv.conf"

nsjail/run.python3.config.proto

@@ -96,6 +96,13 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/etc/pki"
+    dst: "/etc/pki"
+    is_bind: true
+    mandatory: false
+}
+
 mount {
     src: "/etc/resolv.conf"
     dst: "/etc/resolv.conf"