Enable NSS PKIX verifier for secureboot signature checks

During image creation, bottlerocket uses the `pesigcheck` utility to verify secureboot signatures on all signed artifacts. The signature validation is implemented via libnss.

Bottlerocket SDK 0.43.0 release will move to NSS 3.101.

In NSS 3.101, lib::pkix was enabled as the default X.509 validator. This causes `pesigcheck` to fail with "Peer's Certificate issuer is not recognized," despite the CA issuer being provided to `pesigcheck` for the check.

Start by tracing the image-creation path that invokes the `pesigcheck` utility and inspect how libnss is configured for signature validation. Reproduce the failure with NSS 3.101 and confirm that signed artifacts validate when their CA issuer is supplied; done means secureboot checks no longer report that the certificate issuer is unrecognized.

Written by the indexing model from the issue text.