`cert_pool`: add `combined`/`multi` and `system`

### Issue Details

`combined` merges multiple roots sources, and system just pulls from `x509.SystemCertPool()`

### Assistance Disclosure

AI not used

### If AI was used, describe the extent to which it was used.

_No response_