[vault] Validate sig.xml certificate chain

Validate that a valid chain of certificates can be built from the
contents of the sig.xml file. This roughly follows the ChromeOS
integration [1].

[1] https://docs.google.com/document/d/1UF49mcnzqcWk8-x3ATbZ1-9yzXI50PeMg4WwmKrf4p0/edit?pli=1&resourcekey=0-OSbc6OYwPBTmb_YNUv9jFQ&tab=t.0#bookmark=id.30crs17eawy

Bug: 399818721
Change-Id: I8819c1a0103e9d346fd586ea94189ce57d99ccda
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6505550
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Matt Mueller <mattm@chromium.org>
Commit-Queue: Nina Satragno <nsatragno@chromium.org>
Reviewed-by: Maksim Moskvitin <mmoskvitin@google.com>
Cr-Commit-Position: refs/heads/main@{#1457654}