`CollectTrustedRootCertificatesPem` doesn't take Intermediate CA

Nobody has claimed this yet.

### Windows Version

10.0.26100.33158

### WSL Version

2.9.4.0

### Are you using WSL 1 or WSL 2?

- [x] WSL 2
- [ ] WSL 1

### Kernel Version

6.18.35.2-1

### Distro Version

_No response_

### Other Software

_No response_

### Repro Steps

* Have the following PKI
```
ROOT ÇA
\ INTERMEDIATE CA
\ CERTIFICATE [docker.mycorp]
```
* have a docker repository that serves the HTTP endpoint using `docker.mycorp`
* on the windows host, have the ROOT CA in 'Trusted Root Certification Authorities' and the INTERMEDIATE CA in 'Intermediate Certification Authorities'
* `docker pull docker.mycorp/hello_world:latest`

### Expected Behavior

It works.

### Actual Behavior

The x509 certificate is rejected because intermediate certificates aren't also imported by `CollectTrustedRootCertificatesPem`. This can be an issue in an enterprise environment where those are populated automatically. Maybe the intermediate certificates should be included also ?

I can workaround the issue by adding the intermediate CA to "Trusted Root" and restarting.

### Diagnostic Logs

_No response_

Start with the reported Docker pull reproduction and trace the CollectTrustedRootCertificatesPem entry point, focusing on how Windows Trusted Root Certification Authorities and Intermediate Certification Authorities are handled. Done means docker.mycorp/hello_world:latest pulls successfully when the root and intermediate certificates are stored in their respective Windows certificate stores.

Written by the indexing model from the issue text.