Long-running process will not fetch updated Fulcio certificates

[haydentherapper]

initRoots initializes a TUF environment and will update the target metadata if expired. The results of initRoots are persisted in a singleton to prevent repeated lookups of the certificates from the local TUF repo. The issue is that the TUF metadata may expire, but the singleton will prevent fetching the potentially-updated Fulcio roots.

I'd propose removing the singleton and always read from the TUF metadata. Alternatively the TUF client could persist the certificates and update its copy when the TUF metadata expires.