Update to v2.21.0
    
    Also adjust the patch that forces the system CA bundle to be used so
    that behavior doesn't change if python-certifi is installed. It's
    patched to point at the system CA bundle as well, but there's no reason
    we need to assume that or use it.