### Summary

When attempting to use the `uri` module to connect to a server using a self-signed certificate, the module will fail with an SSL related error since it cannot trust the endpoint. The `ca_path` parameter was introduced in a later version of the module to manually pass a CA certificate in order to establish trust. The problem is that the `ca_path` parameter is configured to expect only one certificate in the given CA certificate file and does not properly handle a CA bundle. This is problematic because the underlying Python `urllib.request.urlopen` function supports both formats and will fail in some cases when a full chain (bundle) is not provided. 

### Issue Type

Bug Report

### Component Name

uri

### Ansible Version

```console
$ ansible --version
ansible [core 2.11.1]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.8/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.8.5 (default, May 27 2021, 13:30:53) [GCC 9.3.0]
  jinja version = 3.0.1
  libyaml = True
```


### Configuration

```console
$ ansible-config dump --only-changed
(None)
```


### OS / Environment

Ubuntu 20.04

### Steps to Reproduce

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Example request
  ansible.builtin.uri:
    url: "https://localhost/"
    ca_path: /etc/service/bundle.pem
```


### Expected Results

I expected the module to trust the endpoint using the provided CA bundle. This is consistent with how the underlying library works:

```
>>> import urllib.request
>>> req = urllib.request.Request(url='https://localhost/')
>>> with urllib.request.urlopen(req, cafile='/etc/service/bundle.pem') as f:
...       f.read()

b'<!DOCTYPE html>\n<HTML>....
```

### Actual Results

```console
The full traceback is:
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 1755, in fetch_url
    r = open_url(url, data=data, headers=headers, method=method,
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 1535, in open_url
    return Request().open(method, url, data=data, headers=headers, use_proxy=use_proxy,
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 1397, in open
    tmp_ca_path, cadata, paths_checked = ssl_handler.get_ca_certs()
  File "/tmp/ansible_ansible.legacy.uri_payload_elqhsiss/ansible_ansible.legacy.uri_payload.zip/ansible/module_utils/urls.py", line 922, in get_ca_certs
    ssl.PEM_cert_to_DER_cert(
  File "/usr/lib/python3.8/ssl.py", line 1467, in PEM_cert_to_DER_cert
    return base64.decodebytes(d.encode('ASCII', 'strict'))
  File "/usr/lib/python3.8/base64.py", line 546, in decodebytes
    return binascii.a2b_base64(s)
fatal: [nomad03_420a114b-70b6-397b-9ddb-54c0bcac3c70]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "attributes": null,
            "body": null,
            "body_format": "raw",
            "ca_path": "/etc/service/bundle.pem",
            "client_cert": null,
            "client_key": null,
            "creates": null,
            "dest": null,
            "follow_redirects": "safe",
            "force": false,
            "force_basic_auth": false,
            "group": null,
            "headers": {},
            "http_agent": "ansible-httpget",
            "method": "GET",
            "mode": null,
            "owner": null,
            "remote_src": false,
            "removes": null,
            "return_content": false,
            "selevel": null,
            "serole": null,
            "setype": null,
            "seuser": null,
            "src": null,
            "status_code": [
                200
            ],
            "timeout": 30,
            "unix_socket": null,
            "unsafe_writes": false,
            "url": "https://localhost/",
            "url_password": null,
            "url_username": null,
            "use_gssapi": false,
            "use_proxy": true,
            "validate_certs": true
        }
    },
    "msg": "Incorrect padding",
    "status": -1,
    "url": "https://localhost/"
}
```


### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct
#
#
#
#
'''
The **urls** utils module offers a replacement for the urllib2 python library.
urllib2 is the python stdlib way to retrieve files from the Internet but it
lacks some security features (around verifying SSL certificates) that users
should care about in most situations. Using the functions in this module corrects
deficiencies in the urllib2 module wherever possible.
There are also third-party libraries (for instance, requests) which can be used
to replace urllib2 with a more secure library. However, all third party libraries
require that the library be installed on the managed machine. That is an extra step
for users making use of a module. If possible, avoid third party libraries by using
this code instead.
'''
from __future__ import (absolute_import, division, print_function)
__metaclass__ = type
import atexit
import base64
import email.mime.multipart
import email.mime.nonmultipart
import email.mime.application
import email.parser
import email.utils
import functools
import mimetypes
import netrc