[PM-33760] Unpin libnss3-tools

[jprusik]

🎟️ Tracking

PM-33760

📔 Objective

Because the Github action runner uses a newer version of libnss3-tools natively, a downgrade is required to meet the pinned version. We should be able to forgo this by removing the pin (it's only used for certutil).

[github-actions]

Checkmarx One – Scan Summary & Details – fc8116c4-9588-41fc-b11b-25f32918a69d

Great job! No new security vulnerabilities introduced in this pull request

[claude]

Claude finished @jprusik's task in 1m 38s —— View job

---

I'll analyze this and get back to you.

[claude]

Overall Assessment: APPROVE

Reviewed the unpinning of libnss3-tools across all four workflow files. The change removes the version pin (2:3.98-1build1) that was forcing a downgrade on newer GitHub Action runners, and adds the -y flag for non-interactive CI installs. All four workflow files are updated consistently, and no references to the old pinned version remain in the repository.

Code Review Details

No findings. The change is minimal, consistent, and correctly scoped. The package comes from the official Ubuntu apt repository and is only used for certutil in the SSL certificate setup step.