openntpd: fix constraints feature on NixOS

The OpenNTPD constraints feature requires a valid chain of SSL
certificates, but the default path in openntpd didn't match the one in
NixOS.

Unfortunately the configured certificate path becomes hardcoded into the
binary, so this feature will likely still fail on other
distributions/operating systems, unless the path coincides with the
NixOS path or the user sets up a symlink.

pkgs/tools/networking/openntpd/default.nix

@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
     "--with-privsep-user=${privsepUser}"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
+    "--with-cacert=/etc/ssl/certs/ca-certificates.crt"
   ];
 
   buildInputs = [ libressl ];