Check root CA certificates into the repo instead of downloading at build time

[lbussell]

Currently, the ImageBuilder Dockerfile downloads root CA certificates from microsoft.com/pkiops at build time:

docker-tools/src/Dockerfile.linux

Lines 9 to 15 in 30a3bfe

	# download root CA certificates for signature verification
	WORKDIR /
	RUN mkdir -p notation-trust/certs/test notation-trust/certs/supplychain \
	&& curl -fSL --output notation-trust/certs/test/root-ca.crt \
	"https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Testing%20Root%20Certificate%20Authority%202019.crt" \
	&& curl -fSL --output notation-trust/certs/supplychain/root-ca.crt \
	"https://www.microsoft.com/pkiops/certs/Microsoft%20Supply%20Chain%20RSA%20Root%20CA%202022.crt"

Instead, we should check the certificate files into the repo and COPY them in the Dockerfile. The certificates are public root CAs that change very infrequently, so there is no freshness benefit to downloading them on every build.