migrate to supplying x.509 CA certificates in a bundle rather than separate root and intermediate certs

[ChaosInTheCRD]

Currently Witness requires that root certs are supplied separately to intermediate certs like so:

  "roots": {
    "test": {
      "certificate": <base64-encoded-root-cert-pem>,
      "intermediates": [
        <base64-encoded-intermediate-cert-pem>
      ]
    }
  },

Instead, allowing the user to supply all the necessary certs (root and intermediate) as a single pem encoded trustbundle would be an easier experience:

  "roots": {
    "test": {
      "trustBundle": <base64-encoded-trust-bundle-pem>
    }
  },

[ChaosInTheCRD]

it's worth noting that investigating how the upstream in-toto policy language handles this process.

[colek42]

I've seen this pattern more in the wild than what we use. If we change it we should try to support the legacy fields.