Monitor certificates from truststore in SslMeterBinder

[bbbbooo]

Problem

SslMeterBinder currently publishes expiry metrics only for certificate chains from the key store.

As a result, trust store certificate chains are not included in ssl.chain.expiry metrics and their expiry cannot be monitored.

When the same chain alias exists in both the key store and trust store, the metrics also need a way to distinguish their source.

Changes

Update SslMeterBinder to publish expiry metrics for trust store certificate chains in addition to key store chains.

Add a store tag with values key and trust so that key store and trust store metrics can be distinguished.

Update the reference documentation for ssl.chain.expiry to describe trust store coverage and the new tag.

Tests

Added/updated tests to cover.

• trust store-only bundle registration
• key store and trust store metrics with the same chain aliases
• trust store metric updates when bundles are registered and updated after binder construction

Fixes #49325

[bbbbooo]

I believe I’ve addressed the earlier feedback, but please let me know if there’s anything else I should update.
Thanks!

[mhalbritter]

Thanks @bbbbooo !