Reload roots and/or automatically fetch them from CCADB

[FiloSottile]

No description provided.

[Copilot]

Pull Request Overview

This PR adds persistence, dynamic reloading, and CCADB-based updating of trusted root certificates for the CT log.

• Persist initial empty roots in object storage (_roots.pem) during log creation
• Introduce thread-safe in-memory root pool with SetRootsFromPEM and rootPool
• Add SIGHUP reload and periodic CCADB/ExtraRoots fetching in the CLI

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
internal/ctlog/testlog_test.go	Update tests to initialize roots via SetRootsFromPEM
internal/ctlog/http.go	Switch chain validation and root endpoint to use rootPool()
internal/ctlog/ctlog_test.go	Adjust sequence upload path tests to include _roots.pem
internal/ctlog/ctlog.go	Add _roots.pem upload/fetch, in-memory root pool, and reloads
cmd/sunlight/sunlight.go	Implement SIGHUP root reload logic and CCADBRoots/ExtraRoots flags
cmd/sunlight/roots.go	Implement CCADB/ExtraRoots fetching and merging into pool
cmd/sunlight/roots_test.go	Add tests for CCADBRoots