Make ca_hashes up-to-date test platform-independent

The test compared the regenerated etc/ca_hashes.txt byte-for-byte
against the committed file, but two aspects are not stable across
platforms:

- The name column comes from 'openssl x509 -subject', which formats
  differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
  BSD libc and glibc even under an identically-named locale.

Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:

- The test now compares the set of SPKI hashes (field 1) between the
  committed and regenerated files, order-independently, using
  'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
  sort collation ('LC_ALL=C') so the generated file is stable.

Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).

utils/create_ca_hashes.sh

@@ -33,7 +33,7 @@ for bundle_fname in etc/*.pem; do
    		echo -n "."
         hpkp_key_ca="$( ( openssl x509 -in "$cert_fname" -pubkey -noout | grep -v PUBLIC | openssl base64 -d |
             openssl dgst -sha256 -binary | openssl enc -base64 ) 2>/dev/null )"
-		hpkp_name=$( openssl x509 -in "$cert_fname" -subject -noout 2>/dev/null | sed "s/^subject= //")
+		hpkp_name=$( openssl x509 -in "$cert_fname" -subject -noout -nameopt compat 2>/dev/null | sed "s/^subject= //")
 		if [[ $(echo $hpkp_name|grep 'CN='|wc -l) -eq 1 ]]; then
 			hpkp_name=$(echo -n $hpkp_name|sed 's/^.*CN=//'|sed 's/\/.*$//')
 		fi
@@ -45,4 +45,4 @@ done
 # Make a backup first
 cp etc/ca_hashes.txt etc/ca_hashes.txt.bak
 
-sort -u "$TEMPDIR/cahashes" > etc/ca_hashes.txt
+LC_ALL=C sort -u "$TEMPDIR/cahashes" > etc/ca_hashes.txt