feat: tls trust contexts

[hpidcock]

Often it is required on internal systems, to develop a chain of trust using non-
public certificate authorities for establishing TLS connections. A relevant
issue that was raised is #780, where a CA certificate needs to be loaded for
Pebble to connect to a log-target (e.g. loki) to dispatch logs that occur.

Prior to this work, this problem required manipulating the system's CA pool to
add in the relevant trusted CA, then to restart Pebble such that it can load the
CA pool again.

Since charms are a primary use case for Pebble, and since they affect Pebble's
operation via adding layers to the plan, it is more natural for the charm (or an
administrator) to express trust in the plan. Trust contexts provide the means
for CA certificates to be trusted for the various consumers of trust that are
run via Pebble.

This change extends the layer schema with a new trust-contexts top-level field,
in addition to extending services, checks and log-targets with a new
trust-context field to reference the chosen trust context by name.

Here is an example layer/plan that demonstrates trust-contexts:

trust-contexts:
    internal-ca:
        override: replace
        tls:
            ca-cert: |
              -----BEGIN CERTIFICATE-----
              MIIFmzCCA4OgAw...
              -----END CERTIFICATE-----

services:
    nginx-client:
        override: replace
        startup: enabled
        command: sh -c 'curl --fail --verbose --show-error https://nginx.local:8000/ && sleep 10'
        trust-context: internal-ca

checks:
    nginx-exec-check:
        override: replace
        level: alive
        period: 10s
        timeout: 3s
        threshold: 3
        exec:
            command: curl --fail --silent --show-error https://nginx.local:8000/
            trust-context: internal-ca

    nginx-http-check:
        override: replace
        level: ready
        period: 10s
        timeout: 3s
        threshold: 3
        http:
            url: https://nginx.local:8000/
            trust-context: internal-ca

log-targets:
    loki:
        override: replace
        type: loki
        location: https://loki.local:3101/loki/api/v1/push
        services: [all]
        trust-context: internal-ca

    otel:
        override: replace
        type: opentelemetry
        location: https://loki.local:3101/otlp
        services: [all]
        trust-context: internal-ca

In addition to services, checks and log-targets, it is possible to run a command
via pebble exec with a trust context. This is possible by passing --context
with a service name that you wish to adopt the trust context from, in addition
to other existing behaviour taken from the service (e.g. user/group etc.).