Replace CertificatePinner with custom TrustManagerFactory trust store

[cisco-annikiti]

Description

Replace OkHttp's CertificatePinner (SPKI SHA-256 pin verification) with a custom trust store implementation using TrustManagerFactory.init(KeyStore) loaded with bundled root CA PEM certificates.
Changes:

• Created CertificateHelper utility class that loads PEM certificates into a KeyStore, initializes TrustManagerFactory with it, and provides X509TrustManager + SSLSocketFactory
• Modified DuoConnector to accept SSLSocketFactory/X509TrustManager instead of certificate pin strings
• Modified Client.Builder.build() to use CertificateHelper for trust store creation

Motivation and Context

CertificatePinner only checks SPKI hashes without full PKIX validation. A custom TrustManagerFactory trust store provides proper chain validation, removes OS trust store dependency, and simplifies certificate rotation (update PEM file vs recalculating hashes). Aligns with duo_client_java approach

How Has This Been Tested?

• Unit tests for CertificateHelper: verifies 15 certs load from bundle, handles invalid/empty PEM input
• Unit tests for DuoConnector: verifies custom SSLSocketFactory is applied when provided, system defaults used when null
• Unit tests for Client: verifies setCACerts + disableCaPinning mutual exclusion with PEM strings
• All existing unit tests pass (mvn test -pl duo-universal-sdk)

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)