Automate maintenance of trusted roots

In #205 we added a `trusted-roots.jsonl` which is updated by running:

```bash
gh attestation trusted-root > resources/trusted-root.jsonl
```

We could automate;

 * making a PR to update the file
 * making a PR to remove expired certificates