This commit add some additional comments to the `CertificateVerifier.kt`
implementation based on the Android developer docs. In particular:

* A note about the return from `checkServerTrusted` being a list ordered
  from EE to trust anchor.

* A note that after adding a `PKIXRevocationChecker` to
  a `PKIXParameters` it can't be modified further or the effects of the
  modifications will be ignored.

* A note about why `isRevocationEnabled` is set to false on the
  `PKIXRevocationChecker`.

This commit updates the `CertificateVerifier.kt` logic used on Android
to change our revocation checking preferences. Now, we only check the
end entity certificate revocation status, preferring OCSP, and allowing
soft failure.

Checking the entire certificate chain's revocation status is infeasible
with the platform options exposed to us: intermediates without complete
authority information access (AIA) information will hard fail.
Performing only EE revocation checking is preferable to more complicated
logic that attempts to decide apriori whether the chain has enough
information to support complete revocation checking or not.

As a result of only checking EE status the logic and unit test for
determining if a certificate is a known root (one installed in the
system trust store) fall away.

In particular this testcase ensures that we can validate a chain from
EE->intermediate->trust anchor for a chain where one or more
certificates (in this case, the intermediate) are missing an authority
information access (AIA) extension that specifies an OCSP access method
and URI.

1. Rename to `update_valid_ee_certs.bash`
2. Don't hardcode location of `bash` for shebang.
3. Remove echo's about potential future extensions.
4. Add a helper function for fetching EE certs.
5. Use helper to update all three valid realworld testcase EE certs
   instead of just `1password_com_valid_1.crt`