Add timestamp authority (TSA) root certificate to notation trust configuration

Currently, the ImageBuilder notation trust policy does not include a TSA trust store:

https://github.com/dotnet/docker-tools/blob/a221025443c9d012f6511bc8104810d704901877/src/notation-trust/policies/supplychain.json#L8

The .NET image signatures include a timestamp countersignature, and the dotnet-docker verification documentation shows configuring both a `ca` and `tsa` trust store:

https://github.com/dotnet/dotnet-docker/blob/3946d34b71eda376aaeae2e39bf72b6ba3435b5f/documentation/image-signatures.md#L73-L88

We should add the TSA root certificate and reference a `tsa` trust store in the notation trust policy so that ImageBuilder's signature verification validates the timestamp countersignature.

Related: #2079