Add support for non-leaf DNS-over-TLS pinning

This is required by the pinning specification (RFC 7469).
It allows more flexible server management than leaf-only
pinning.

Includes integration tests for fingerprints from
the middle and root of a certificate chain.

Test: Integration tests pass
Bug: 63448475
Change-Id: I65d1255b8dac005d4ab0859c8e8abda84d7b96f8