core: add "tls-ca-path" option

Some organizations will want to use private Certificate Authorities to
serve content to their clients.  While it's possible to add the CA
to the system-wide CA store, that has two drawbacks:

1) Compromise of that cert means it can be used for other web traffic
2) All of ca-certificates is trusted

This patch allows a much stronger scenario where *only* the CAs in
tls-ca-path are used for verification from the given repository.

https://bugzilla.gnome.org/show_bug.cgi?id=726256

src/libostree/ostree-fetcher.c

@@ -233,6 +233,16 @@ _ostree_fetcher_set_client_cert (OstreeFetcher *fetcher,
     }
 }
 
+void
+_ostree_fetcher_set_tls_database (OstreeFetcher *self,
+                                  GTlsDatabase  *db)
+{
+  if (db)
+    g_object_set ((GObject*)self->session, "tls-database", db, NULL);
+  else
+    g_object_set ((GObject*)self->session, "ssl-use-system-ca-file", TRUE, NULL);
+}
+
 static void
 on_request_sent (GObject        *object, GAsyncResult   *result, gpointer        user_data);