Add support for ClientTrustConfig

[haydentherapper]

Description

A ClientTrustConfig message wraps a TrustRoot and a SigningConfig, the latter specifying which URLs should be contacted to fetch a signing certificate, fetch an identity token, log a signing event, and get a signed timestamp.

This standardizes support for bring-your-own-infrastructure without the need to configure each client or bake in any URLs from the public good infrastructure.