Backport #11610 to 2.20 maintenance (backport #11686)

[mergify]

Motivation

Context

• Manual backport of fix passing CA files into builtins:fetchurl sandbox #11610
• Trivial backport of Fix the access of symlinks to host files in the sandbox #10482 (dependency for tests to pass)
  • As requested: DNS resolution breaks on NixOS when having static resolv.conf #11004 (comment)
• Trivial backport of feat: better warning for common SSL error #11246 (dependency for tests to pass)
• Closes fix passing CA files into builtins:fetchurl sandbox (backport #11610) #11645

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

---

This is an automatic backport of pull request #11686 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 9b818f1 has failed:

On branch mergify/bp/2.19-maintenance/pr-11686
Your branch is up to date with 'origin/2.19-maintenance'.

You are currently cherry-picking commit 9b818f14d.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   src/libstore/build/local-derivation-goal.cc
	both modified:   src/libstore/builtins/fetchurl.cc

no changes added to commit (use "git add" and/or "git commit -a")

Cherry-pick of 1cc79f1 has failed:

On branch mergify/bp/2.19-maintenance/pr-11686
Your branch is ahead of 'origin/2.19-maintenance' by 1 commit.
  (use "git push" to publish your local commits)

You are currently cherry-picking commit 1cc79f134.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   tests/functional/linux-sandbox.sh

no changes added to commit (use "git add" and/or "git commit -a")

Cherry-pick of e8e62c9 has failed:

On branch mergify/bp/2.19-maintenance/pr-11686
Your branch is ahead of 'origin/2.19-maintenance' by 2 commits.
  (use "git push" to publish your local commits)

You are currently cherry-picking commit e8e62c95d.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   tests/functional/linux-sandbox.sh

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[roberth]

• Duplicate of Backport #11610 to 2.19 maintenance #11693

I wasn't thinking when I added the label to trigger this. Sorry for the noise.