`rustls_platform_verifier::Verifier::new_with_extra_roots`: Improve error clarity for invalid certificates

The error returned by rustls_platform_verifier::Verifier::new_with_extra_roots doesn't specify which of the provided extra roots was invalid:

    pub fn new_with_extra_roots(
        roots: impl IntoIterator<Item = pki_types::CertificateDer<'static>>,
        crypto_provider: Arc<CryptoProvider>,
    ) -> Result<Self, TlsError> {
        let extra_roots = roots
            .into_iter()
            .map(|root| {
                SecCertificate::from_der(&root)
                    .map_err(|_| TlsError::InvalidCertificate(CertificateError::BadEncoding))
            })
            .collect::<Result<Vec<_>, _>>()?;
        Ok(Self {
            extra_roots,
            #[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
            test_only_root_ca_override: None,
            crypto_provider,
        })
    }

Would there be a way (and interest) in at least mentioning the index of the faulty certificate?

Start at rustls_platform_verifier::Verifier::new_with_extra_roots, especially the extra-roots conversion shown in the issue, and inspect how TlsError represents invalid certificates. Define the error wording and index behavior, then verify that an invalid root identifies its position without changing successful root handling.