Add cron job to fetch trusted roots for MTC

[lukevalenta]

Add a cron job that runs once per day and updates trusted roots for MTC.

Remove the option to manually load in roots for the MTCA, and exclusively use the CCADB list.

Substantiative differences from the static CT's CCADB cron job:

• Instead of using the union of trusted roots from a manually supplied roots file and various root stores, we use the intersection of the Chrome and Mozilla trust stores, since Chrome needs to validate bootstrap chains, and we're using Mozilla's CRLite filters for revocation checks.
• Instead of making the trusted roots append-only, the roots list is pruned. (If Chrome removes a trusted root, we want to remove it as well.)
• Instead of each log shard storing its own roots file in KV, we just use a single file, since we're just staying in sync with the CCADB list.
• Don't import the 'CT Monitoring' root.