Add CA chain to MQTT configuration surface for PubSub

[marcschier]

Supporting a CA chain collection is a reasonable enhancement to the MQTT TLS configuration surface. (From #3911 (comment))

[marcschier]

Implemented in PR #3892 (branch part14pubsub, commit 4149133).

MqttTlsOptions now exposes TrustedIssuerCertificateSubjects (a list of CA subject DNs or thumbprints). The referenced CA certificates are resolved from the application's trusted issuer store (SecurityConfiguration.TrustedIssuerCertificates) and supplied to the MQTT broker handshake as the trust anchor set — MQTTnet v5 via WithTrustChain, and MQTTnet v4 (net48/net472/netstandard2.1) via a fail-closed custom certificate-validation handler that only accepts a broker certificate chaining to a configured CA. Only public CA certificates are referenced, so no certificate material is embedded in configuration files. See Docs/PubSub.md (MQTT TLS configuration).