make ScopedTestRoot the only interface for adding test roots

TestRootCerts::Add or AddFromFile are just an invitation for flaky unit
tests. (The flakes were usually hidden due to ordering and/or bot retries, but could be observed locally if you say, run net_unittests with --gtest_shuffle.)

ScopedTestRoot itself isn't perfect, if multiple instances exist at once they could end up stomping on each other when calling Clear(), but this doesn't seem to be a problem in existing tests. Importantly, if it does occur, it would only affect tests that trigger the behavior and not random other tests. If that does become a problem ScopedTestRoot could be improved to do some sort of refcounting of added roots or somesuch.

Change-Id: I7f74f2a8a33238b66d25cf3fe55695c1c57af00e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3820242
Reviewed-by: Maks Orlovich <morlovich@chromium.org>
Reviewed-by: Joe DeBlasio <jdeblasio@chromium.org>
Auto-Submit: Matt Mueller <mattm@chromium.org>
Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org>
Commit-Queue: Maks Orlovich <morlovich@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1034255}