[INFRA-1502] bake the new UC root CA.

The current UC root CA will expire in 2021. Since this key certificate
is baked into jenkins.war, it needs a plenty of time to rotate. I think
two years window would be sufficient, but since I looked, we might as
well start now.

The new key is also now 4096 bits, upgraded from previous 2048 bits.

I've also used the opportunity to remove old hudson-community root CA,
which was used during the transition period from me leaving Sun and the
birth of Jenkins. It's been long since we stopped using this cert, so no
need to honor it anymore.