x509: rework issuer callback

x509: rework issuer callback

The previous issuer callback API had a drawback: the callback is
supposed to add CA to the trust list by itself.  This was error-prone,
because the callback must check the new CA is trusted by the already
added CA.  This instead moves the responsibility to the library.

This also rewrites the chain amendment logic in a side-effect free
manner.  The application can assume that the trust information stored
on gnutls_x509_trust_list_t shouldn't change after the verification.

The missingissuer test has been extended to cover all the possible
patterns exhaustively.

Signed-off-by: Daiki Ueno <ueno@gnu.org>