Merge "Move retired CA certs to optional array" into android12L-tests-dev