security/ca_root_nss: Update to 3.129
Changes to the certificate store since 3.128:
- Removed Izenpe.com (server distrust after 2026-04-15, Mozilla bug 2017322: the attribute was set on the PKCS#11 trust object instead of the certificate object, so it did not take effect until now)
Changelog:
https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/ux-yy4Yk33U
MFH: 2026Q3
Sponsored by: Netzkommune GmbH
(cherry picked from commit f2f3940dcd641a9624fd40229d8c1b58fabdbd48)