Print better errors for CA matching

[strawgate]

When we use a trusted fingerprint for our ca, the behavior is very different than using a ca cert.

Let's make this behavior super friendly to users and instead of printing

no CA certificate matching the fingerprint let's add the fingerprint to the log message!

Similarly, if the peer certificate we're looking at does not contain a CA cert, because Elasticsearch's cert is not a full chain, let's print that too.

This way, everyone will be very happy

[botelastic]

This issue doesn't have a Team:<team> label.

[strawgate]

If that PR merges I'll bump the lib dependencies in beats to close this issue