Dont allow unknown issuer when we have a custom root-of-trust

[ameba23]

Fix AttestedCertificateVerifier so a configured private RootCertStore will not allow an UnknownIssuer error.

This changes the server and client certificate verifiers:

• If there is a configured private CA (root of trust) it is used to verify the cert, and UnknownIssue error will result in failure.
• Otherwise allow self-signed attested certs with the existing manual name/time validation.

Added tests covering both server and client verification with given root of trust.

Closes #25