crypto/x509: re-enable TestSystemRoots
crypto/x509: re-enable TestSystemRoots

Now that the cgo and no-cgo paths should be correct and equivalent,
re-enable the TestSystemRoots test without any margin of error (which
was tripping anyway when users had too many of a certain edge-case).

As a last quirk, the verify-cert invocation will validate certificates
that aren't roots, but are signed by valid roots. Ignore them.

Fixes #24652

Change-Id: I6a8ff3c2282136d7122a4e7e387eb8014da0d28a
Reviewed-on: https://go-review.googlesource.com/c/128117
TryBot-Result: Gobot Gobot <66cb808b70d30c07676d5e946fee83fd561249e5@golang.org>
Run-TryBot: Filippo Valsorda <4f40cda291c5f9634e1affd3db44947af61f705c@golang.org>
Reviewed-by: Adam Langley <db68fba232b2c49ed3e9d3081df349dde7b61dfd@golang.org>

CAFxX/go,josharian/go,akutz/go,golang/go,nawawi/go,josharian/go,akutz/go,nawawi/go,cloudflare/go,josharian/go,akutz/go,CAFxX/go,nawawi/go,nawawi/go,akutz/go,nawawi/go,josharian/go,akutz/go,cloudflare/go,CAFxX/go,josharian/go,golang/go,cloudflare/go,golang/go,cloudflare/go,cloudflare/go,CAFxX/go,josharian/go,CAFxX/go,akutz/go,cloudflare/go,golang/go,golang/go,cloudflare/go,cloudflare/go,golang/go,josharian/go,golang/go,nawawi/go,CAFxX/go,nawawi/go,akutz/go,josharian/go,nawawi/go,akutz/go,CAFxX/go,CAFxX/go,golang/go