Plumb ca_certs_path to the plugin resolver. (pantsbuild#10910)

This should be the last place `ca_certs_path` needs plumbing.

src/python/pants/init/plugin_resolver.py

@@ -11,6 +11,7 @@
 
 from pex import resolver
 from pex.interpreter import PythonInterpreter
+from pex.network_configuration import NetworkConfiguration
 from pkg_resources import Distribution, WorkingSet
 from pkg_resources import working_set as global_working_set
 
@@ -103,6 +104,9 @@ def _resolve_plugins(self) -> Iterable[str]:
             interpreter=self._interpreter,
             cache=self.plugin_cache_dir,
             allow_prereleases=PANTS_SEMVER.is_prerelease,
+            network_configuration=NetworkConfiguration.create(
+                cert=self._global_options.options.ca_certs_path
+            ),
         )
         return [
             self._install_plugin(resolved_dist.distribution) for resolved_dist in resolved_dists
@@ -165,13 +169,16 @@ def plugin_cache_dir(self) -> str:
         """The path of the directory pants plugins bdists are cached in."""
         return self._plugin_cache_dir
 
+    @memoized_property
+    def _global_options(self):
+        return self._create_global_subsystem(GlobalOptions)
+
     @memoized_property
     def _python_repos(self) -> PythonRepos:
         return self._create_global_subsystem(PythonRepos)
 
-    def _create_global_subsystem(self, subsystem_type: Type[S]) -> S:
-        options_scope = cast(str, subsystem_type.options_scope)
-
+    @memoized_property
+    def _defaulted_only_options(self):
         # NB: The PluginResolver runs very early in the pants startup sequence before the standard
         # Subsystem facility is wired up.  As a result PluginResolver is not itself a Subsystem with
         # PythonRepos as a dependency.  Instead it does the minimum possible work to hand-roll
@@ -185,7 +192,10 @@ def _create_global_subsystem(self, subsystem_type: Type[S]) -> S:
         # Ignore command line flags since we'd blow up on any we don't understand (most of them).
         # If someone wants to bootstrap plugins in a one-off custom way they'll need to use env vars
         # or a --pants-config-files pointing to a custom pants.toml snippet.
-        defaulted_only_options = options.drop_flag_values()
+        return options.drop_flag_values()
+
+    def _create_global_subsystem(self, subsystem_type: Type[S]) -> S:
+        options_scope = cast(str, subsystem_type.options_scope)
 
         # Finally, construct the Subsystem.
-        return subsystem_type(options_scope, defaulted_only_options.for_scope(options_scope))
+        return subsystem_type(options_scope, self._defaulted_only_options.for_scope(options_scope))