Replace CertificatePinner with custom trust store using TrustManagerFactory

[cisco-annikiti]

Description

Replace OkHttp's CertificatePinner (SPKI SHA-256 hash matching) with a custom trust store implementation using TrustManagerFactory initialized with a bundled KeyStore of root CA certificates.

Motivation and Context

CertificatePinner performs SPKI hash matching after TrustManager validation - it doesn't restrict the trust anchor set itself. The custom trust store approach restricts trust anchors at the TLS layer, provides full PKIX chain validation (signatures, expiry, chain building), and aligns with the standardized CA pinning approach across all Duo client libraries

How Has This Been Tested?

• All existing unit tests pass (mvn test - 41 tests, 0 failures)
• Added CertificateUtilsTest - verifies PEM loading, KeyStore creation, TrustManagerFactory initialization, and error handling
• Updated HttpDisableCaPinningTest - verifies custom SSLSocketFactory is used by default, system trust store is used when pinning is disabled, and mutual exclusivity of options
• Verified TLS handshake succeeds against a real Duo API host with the bundled trust store
• Verified TLS handshake is rejected when using a trust store without the correct CAs (negative test)

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)