Complete HederaTrustManager certificate validation

`HederaTrustManager` (`sdk/src/main/java/com/hedera/hashgraph/sdk/HederaTrustManager.java`) is the `X509TrustManager` used for consensus-node TLS, and it is only a partial implementation:

- `checkServerTrusted` only PEM-encodes each certificate in the chain and compares its SHA-384 hash against the address-book `certHash`. There is no standard X.509 path validation — issuer chain, signatures, and expiry/validity windows are never checked.
- When the address book carries no cert hash and `verifyCertificate` is off, the constructor logs `skipping certificate check since no cert hash was found` and `checkServerTrusted` then accepts any chain.
- `checkClientTrusted` throws `UnsupportedOperationException`, and `getAcceptedIssuers()` returns an empty array.

For certificate pinning and custom-network TLS this should be completed: run proper chain validation (e.g. delegate to the platform default trust manager) in addition to the address-book hash pin, define the behavior when only some nodes have cert hashes, and add unit tests around `checkServerTrusted` (matching hash, non-matching hash, empty hash, expired cert).

Start in sdk/src/main/java/com/hedera/hashgraph/sdk/HederaTrustManager.java by reading the constructor, checkServerTrusted, checkClientTrusted, and getAcceptedIssuers(). Add unit coverage for matching, non-matching, and empty certificate hashes plus expired certificates, and decide the behavior when only some nodes have hashes. Done means standard X.509 validation and address-book pinning both work without accepting an unchecked chain.

Written by the indexing model from the issue text.