We always either build nss or use the system one, so there isn't a case where
we want to bundle the ancient nss in the pre-builds