cga: Provide a virtual trust anchor for CGA parameter certificates

cga: Provide a virtual trust anchor for CGA parameter certificates

To give CGA parameters trust, we must validate it as certificate. To do so, a
static credential set provides a CA certificate as virtual trust anchor. If
enabled, any valid CGA parameters certificate can authenticate a matching IPv6
CGA identity.

As this allows any user to successfully authenticate with an IPv6 CGA, care
must be taken to limit connections to make use of CGA authenticated identities.
This is achieved by requiring a "trust" option to be explicitly enabled by the
administrator.