Provide a hint as to the likely cause of failure to find a valid issuer

[briansmith]

Multiple times people have asked for a way to learn something more than UnknownIssuer when webpki fails to build a path. For example, if the end-entity certificate is signed using an algorithm that wasn't enabled, them it would be useful to get an "certificate signed with an unsupported algorithm" error instead of just getting "unknown issuer." So far I've avoided doing this because it adds complexity in an attempt to provide precision that isn't, in general, warranted. However, it's true that often the more precise error is more useful for diagnosing a configuration issue than "unknown issuer" is.

Previously, we considered logic similar to what Firefox does: If every attempt to build a path fails for the same reason, then return that reason; otherwise, return "unknown issuer" like today. We should reconsider doing at least this.