store: add basic certificate pinning

[mvo5]

Some questions we need to discuss:

1. What endpoints to pin certs? strawman:
   a) login.ubuntu.com because it gets passwords
   b) search.apps.ubuntu.com because the client trusts the data without additional checks
   c) NOT public.apps.ubuntu.com - we check snaps based on assertions
   d) NOT assertions.ubuntu.com - we cross check assertions anyway
   e) myapps.developer.ubuntu.com - icons?
2. public.apps.ubuntu.com redirects to a https internapcdn.net site for snap downloads:
   a) do not use https for snapdownloads
   b) disable cert pinning for snap downloads
3. how to manage whitelist of pinned certs?
   a1) create new valid-certs-assertions
   a2) disable cert pinning for assertions.ubuntu.com
   a3) refresh valid-certs-assertion regularly
   a4) use content of valid-cert-assertion for the cert checks

[mvo5]

Closing for now as there is more work here