On macOS 10.11, but not 10.10 and 10.12, the C API returns 5 old root
CAs which are not in SystemRootCertificates.keychain (but seem to be in
X509Anchors and maybe SystemCACertificates.keychain, along with many
others that the C API does not return). They all are moribund 1024-bit
roots which are now gone from the Apple store.

Since we can't seem to find a way to make the no-cgo code see them,
ignore them rather than skipping the test.

Fixes #21416

Change-Id: I24ff0461f71cec953b888a60b05b99bc37dad2ed
Reviewed-on: https://go-review.googlesource.com/c/156329Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>