sslutil: add assertion to prevent accidental CA usage on Windows
Yuya suggested we add this check to ensure we don't accidentally try
to load user-writable paths on Windows if we change the control
flow of this function later.
osx: explicitly build hg with /usr/bin/python2.7
This should help avoid creating a package that depends on a custom
Python, as happened when I built a package for 3.8.