Use either the system root pool or an empty cert pool with custom CA roots, and not a joint system+custom CA roots pool, when connecting from a docker client to a remote daemon.
Use either the system root pool or an empty cert pool with custom CA roots,
and not a joint system+custom CA roots pool, when connecting from a docker
client to a remote daemon.

Signed-off-by: Ying Li <f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com>

docker/cli,e11137/cli,ashfall/cli,allencloud/cli,Zebrilee/cli,dnephin/cli,cpuguy83/cli,cpuguy83/cli,Zebrilee/cli,riyazdf/cli,gdevillele/cli,allencloud/cli,thaJeztah/cli,redpanda/cli,docker/cli,riyazdf/cli,e11137/cli,ashfall/cli,redpanda/cli,dnephin/cli,thaJeztah/cli