fix(http): reject Hackney's certifi partial chains

Hackney 4 merges given ssl_options into its defaults and keeps its own
partial_chain, which trusts any certificate in the peer chain that is in
certifi. A peer could send the emSign ECC Root CA - G3 root in its chain
and pass. Set partial_chain so certifi is never a trust anchor.

test/pleroma/http/tls_test.exs

@@ -17,6 +17,12 @@ defmodule Pleroma.HTTP.TLSTest do
       assert is_function(match_fun, 2)
     end
 
+    test "does not accept certificates from the peer chain as trust anchors" do
+      partial_chain = TLS.ssl_options()[:partial_chain]
+
+      assert partial_chain.([:certificate]) == :unknown_ca
+    end
+
     test "keeps the CA bundle when other options are given" do
       opts = TLS.ssl_options(versions: [:"tlsv1.2"])