fix ssl: respect SSL_CERT_FILE and REQUESTS_CA_BUNDLE for CA bundle

[Tyagiquamar]

What changed

• massive/rest/base.py: new _default_ca_bundle() helper returns SSL_CERT_FILE if set, else REQUESTS_CA_BUNDLE if set, else certifi.where(). BaseClient now passes it as ca_certs to the urllib3.PoolManager instead of hardcoded certifi.where().
• massive/websocket/__init__.py: the wss:// SSLContext loads verify locations from the same helper (removes the now-unused direct certifi import).
• Added test_rest/test_ssl_ca_bundle.py with 3 tests (precedence, fallback, certifi default) asserting both the helper and the pool connection_pool_kw.

Why

Fixes #998. Behind TLS-inspecting corporate proxies the SDK failed with CERTIFICATE_VERIFY_FAILED because it always used the bundled certifi CA, ignoring the standard env vars that requests, httpx, and urllib3 conventions honor.

Testing

Docker python:3.11-bookworm:

• python -m unittest test_rest.test_ssl_ca_bundle — 3 passed; errors on base (helper absent, env ignored).
• Full python -m unittest discover -s test_rest — 42 passed.
• black --check on all three touched files — clean (repo uses black per Makefile).