builtin:fetchurl: Enable TLS verification (backport #11585)

[mergify]

Motivation

Once upon a time we disabled this because we didn't have access to the certificates in the sandbox, and verification wasn't really needed because we're checking the hash of the download afterwards. But these days we do have access to certificates in the sandbox, and features like impure derivations make the second assumption no longer valid. So let's re-enable checking.

Context

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

---

This is an automatic backport of pull request #11585 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of f2f47fa has failed:

On branch mergify/bp/2.21-maintenance/pr-11585
Your branch is ahead of 'origin/2.21-maintenance' by 1 commit.
  (use "git push" to publish your local commits)

You are currently cherry-picking commit f2f47fa72.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   tests/nixos/fetchurl.nix

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   tests/nixos/default.nix

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally