add automated tests for updater cert pinning

This is a spinoff of legacy/trac#17442 (moved). We want to add automated tests to ensure that we notice if Mozilla changes something that breaks the updater cert pinning.