add automated tests for updater cert pinning

This is a spinoff of #17442 (moved). We want to add automated tests to ensure that we notice if Mozilla changes something that breaks the updater cert pinning.