add automated tests for updater cert pinning
This is a spinoff of #17442 (moved). We want to add automated tests to ensure that we notice if Mozilla changes something that breaks the updater cert pinning.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information