Add support for STH-based validation when using `--size` flag

Description

The current behavior of the certificate-transparency-go client when using the --size flag is potentially confusing and could be dangerous in auditing contexts.

Current Behavior

• When using --size <value>: The tool does not validate the inclusion proof
• When omitting --size: The tool does perform validation

This inconsistency may mislead users who aren't deeply familiar with Certificate Transparency internals, as they might reasonably assume the tool validates inclusion proofs consistently regardless of the --size flag.

Proposed Enhancement

1. Primary feature: Allow specifying a previous STH to verify that a historical tree size inclusion proof is actually valid

2. Enhanced feature: Implement a "wait-for-new-updated-sth-before-validating" option that would:

   • Wait for a new STH that includes the specified tree size
   • Then perform the validation against that STH

Benefits

• Eliminates the current confusing behavior difference
• Provides stronger security guarantees for auditing use cases
• Makes the tool's behavior more predictable and safer by default

Additional Context

# This validates the inclusion proof
$ client get-inclusion-proof --log_uri=https://... --cert_chain=cert.pem

# This does NOT validate the inclusion proof (but users might expect it to)
$ client get-inclusion-proof --log_uri=https://... --cert_chain=cert.pem --size=12345

I'm happy to submit a PR for this functionality if there's interest.

Start at the client get-inclusion-proof command and trace how the --size flag currently handles inclusion-proof validation. Review the existing STH and historical tree-size verification paths. Done means a previous STH can be supplied for validation, with the proposed wait-for-a-new-STH behavior clarified and covered by tests.