tests: verify current issuer certificates

[Aryadeepta]

Summary

Adds regression coverage for #922 using a bundle signed with the current
production Fulcio issuer certificates.

The existing test assets were generated against older issuer certificate
chains and did not ensure that SCT verification continued to work with the
current production trust root.

This adds a fresh production signing bundle and verifies it with
Verifier.production(offline=True).

Closes #922

Tested with:

• make lint
• make test

Release Note

None. This is a test-only change.

Documentation

None.

[jku]

Hi, thank you for the test. I'm going to close this as the situation has improved since the the issue was filed 2 years ago: at least the test_fix_bundle_* tests indirectly test this as part of "make test" (I'm not surprised if there are other tests too). Also, pyopenssl was completely removed since then so the original issue should now be impossible

Apologies for leaving the issue open.