Use OS-provided trusted root certs on Linux

CHANGELOG.md

 ## 1.20.0
 
 ### Dart VM
 
 * We have improved the way that the VM locates the native code library for a
   native extension (e.g. `dart-ext:` import). We have updated this
   [article on native extensions](https://www.dartlang.org/articles/dart-vm/native-extensions)
   to reflect the VM's improved behavior.
 
+* We have improved the way the VM searches for trusted root certificates for
+  secure socket connections on Linux. First, the VM will look for trusted root
+  certificates in standard locations on the file system
+  (/etc/pki/tls/certs/ca-bundle.crt followed by /etc/ssl/certs), and only if
+  these do not exist will it fall back on the builtin trusted root certificates.
+  This behavior can be overridden on Linux with the new flags
+  --root-certs-file and --root-certs-cache. The former is the path to a file
+  containing the trusted root certificates, and the latter is the path to a
+  directory containing root certificate files hashed using `c_rehash`.
+
 ### Core library changes
 * `dart:core`: Remove deprecated `Resource` class.
   Use the class in `package:resource` instead.
 * `dart:async`
   * `Future.wait` now catches synchronous errors and returns them in the
     returned Future.
   * More aggressively returns a Future on Stream.cancel operations.
     Discourages to return `null` from `cancel`.
   * Fixes a few bugs where the cancel future wasn't passed through
     transformations.
 * `dart:io`
   * Added `WebSocket.addUtf8Text` to allow sending a pre-encoded text message
     without a round-trip UTF-8 conversion.
 
-## Strong Mode
+### Strong Mode
 
 * Breaking change - it is an error if a generic type parameter cannot be
     inferred (SDK issue [26992](https://github.com/dart-lang/sdk/issues/26992)).
 
     ```dart
     class Cup<T> {
       Cup(T t);
     }
     main() {
       // Error because:
@@ skipping 1221 matching lines @@
     they will keep the Dart process alive until they time out. This fixes the
     handling of persistent connections. Previously, the client would shut down
     immediately after a request.
 
   * **Breaking change:** `HttpServer` no longer compresses all traffic by
     default. The new `autoCompress` property can be set to `true` to re-enable
     compression.
 
 * `dart:isolate`: `Isolate.spawnUri` added the optional `packageRoot` argument,
   which controls how it resolves `package:` URIs.