Pin covenant approval trust roots

[mswilkison]

Summary

• add config-backed depositor and custodian trust roots keyed by route/reserve/network
• enforce self_v1 depositor key pinning and qc_v1 custodian key pinning before artifact approval signature verification
• add focused covenantsigner coverage for matching, mismatched, and missing trust-root entries

Testing

• go test ./pkg/covenantsigner -count=1
• go test ./pkg/tbtc -run 'SignerApprovalCertificate|CovenantSigner' -count=1 -timeout=5m