core: add "tls-ca-path" option

Some organizations will want to use private Certificate Authorities to
serve content to their clients.  While it's possible to add the CA
to the system-wide CA store, that has two drawbacks:

1) Compromise of that cert means it can be used for other web traffic
2) All of ca-certificates is trusted

This patch allows a much stronger scenario where *only* the CAs in
tls-ca-path are used for verification from the given repository.

https://bugzilla.gnome.org/show_bug.cgi?id=726256

doc/ostree.repo-config.xml

@@ -152,6 +152,11 @@ Boston, MA 02111-1307, USA.
         <term><varname>tls-client-key-path</varname></term>
         <listitem><para>Path to file containing client-side certificate key, to present when making requests to this repository.</para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>tls-ca-path</varname></term>
+        <listitem><para>Path to file containing trusted anchors instead of the system CA database.</para></listitem>
+      </varlistentry>
     </variablelist>
 
   </refsect1>