Update to v2.21.0
Also adjust the patch that forces the system CA bundle to be used so
that behavior doesn't change if python-certifi is installed. It's
patched to point at the system CA bundle as well, but there's no reason
we need to assume that or use it.