fix(24.04): reorganise ca-certificates slice(s)

slices/ca-certificates.yaml

@@ -6,6 +6,8 @@ essential:
 slices:
   data:
     contents:
+      # This bundle of certificates is a result of running the update-ca-certificates
+      # For a deb package, this is done by the postinst script.
       /etc/ssl/certs/ca-certificates.crt: {text: FIXME, mutable: true}
       /usr/share/ca-certificates/mozilla/: {until: mutate}
       /usr/share/ca-certificates/mozilla/*: {until: mutate}
@@ -16,6 +18,21 @@ slices:
       ]
       content.write("/etc/ssl/certs/ca-certificates.crt", "".join(certs))
 
+  default-certs:
+    essential:
+      - ca-certificates_data
+    contents:
+      /usr/share/ca-certificates/mozilla/**:
+
+  bins:
+    essential:
+      - openssl_bins
+    contents:
+      # To run update-ca-certificates without breaking the default certificates,
+      # the ca-certificates_default-certs slice should also be included.
+      # Details see the `update-ca-certificates` script.
+      /usr/sbin/update-ca-certificates:
+
   copyright:
     contents:
       /usr/share/doc/ca-certificates/copyright: