### Summary

When attempting to use the `uri` module to connect to a server using a self-signed certificate, the module will fail with an SSL related error since it cannot trust the endpoint. The `ca_path` parameter was introduced in a later version of the module to manually pass a CA certificate in order to establish trust. The problem is that the `ca_path` parameter is configured to expect only one certificate in the given CA certificate file and does not properly handle a CA bundle. This is problematic because the underlying Python `urllib.request.urlopen` function supports both formats and will fail in some cases when a full chain (bundle) is not provided. 

### Issue Type

Bug Report

### Component Name

uri

### Ansible Version

```console
$ ansible --version
ansible [core 2.11.1]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.8/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.8.5 (default, May 27 2021, 13:30:53) [GCC 9.3.0]
  jinja version = 3.0.1
  libyaml = True
```


### Configuration

```console
$ ansible-config dump --only-changed
(None)
```


### OS / Environment

Ubuntu 20.04

### Steps to Reproduce

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Example request
  ansible.builtin.uri:
    url: "https://localhost/"
    ca_path: /etc/service/bundle.pem
```


### Expected Results

I expected the module to trust the endpoint using the provided CA bundle. This is consistent with how the underlying library works:

```
>>> import urllib.request
>>> req = urllib.request.Request(url='https://localhost/')
>>> with urllib.request.urlopen(req, cafile='/etc/service/bundle.pem') as f:
...       f.read()

b'<!DOCTYPE html>\n<HTML>....
```

### Actual Results

```console
The full traceback is:
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 1755, in fetch_url
    r = open_url(url, data=data, headers=headers, method=method,
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 1535, in open_url
    return Request().open(method, url, data=data, headers=headers, use_proxy=use_proxy,
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 1397, in open
    tmp_ca_path, cadata, paths_checked = ssl_handler.get_ca_certs()
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 922, in get_ca_certs
    ssl.PEM_cert_to_DER_cert(
  File "/usr/lib/python3.8/ssl.py", line 1467, in PEM_cert_to_DER_cert
    return base64.decodebytes(d.encode('ASCII', 'strict'))
  File "/usr/lib/python3.8/base64.py", line 546, in decodebytes
    return binascii.a2b_base64(s)
fatal: [nomad03_420a114b-70b6-397b-9ddb-54c0bcac3c70]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "attributes": null,
            "body": null,
            "body_format": "raw",
            "ca_path": "/etc/service/bundle.pem",
            "client_cert": null,
            "client_key": null,
            "creates": null,
            "dest": null,
            "follow_redirects": "safe",
            "force": false,
            "force_basic_auth": false,
            "group": null,
            "headers": {},
            "http_agent": "ansible-httpget",
            "method": "GET",
            "mode": null,
            "owner": null,
            "remote_src": false,
            "removes": null,
            "return_content": false,
            "selevel": null,
            "serole": null,
            "setype": null,
            "seuser": null,
            "src": null,
            "status_code": [
                200
            ],
            "timeout": 30,
            "unix_socket": null,
            "unsafe_writes": false,
            "url": "https://localhost/",
            "url_password": null,
            "url_username": null,
            "use_gssapi": false,
            "use_proxy": true,
            "validate_certs": true
        }
    },
    "msg": "Incorrect padding",
    "status": -1,
    "url": "https://localhost/"
}
```


### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct
'''Inteligently build out the SSLValidationError based on what support
    you have installed
    '''
    msg = [
        ('Failed to validate the SSL certificate for %s:%s.'
         ' Make sure your managed systems have a valid CA'
         ' certificate installed.')
    ]
    if not HAS_SSLCONTEXT:
        msg.append('If the website serving the url uses SNI you need'
                   ' python >= 2.7.9 on your managed machine')
        msg.append(' (the python executable used (%s) is version: %s)' %
                   (sys.executable, ''.join(sys.version.splitlines())))
        if not HAS_URLLIB3_PYOPENSSLCONTEXT and not HAS_URLLIB3_SSL_WRAP_SOCKET:
            msg.append('or you can install the `urllib3`, `pyOpenSSL`,'
                       ' `ndg-httpsclient`, and `pyasn1` python modules')
        msg.append('to perform SNI verification in python >= 2.6.')
    msg.append('You can use validate_certs=False if you do'
               ' not need to confirm the servers identity but this is'
               ' unsafe and not recommended.'
               ' Paths checked for this platform: %s.')
    if exc:
        msg.append('The exception msg was: %s.' % to_native(exc))
    raise SSLValidationError(' '.join(msg) % (hostname, port, ", ".join(paths)))
def atexit_remove_file(filename):