Fetch and save all root certificates during service's certificate rotation

There are a few steps needed before the final piece of root CA rotation can be fully implemented on client side.
DefaultCertificateClient needs the CertificateLifeTime monitor to be updated to be able to run when root ca rotation is scheduled not just when regular certificate rotation is in progress.
SignAndStoreCertificate currently is scattered across 3-4 different places, whereas a central location would fully suffice, and it also needs to be updated to use the new protocol to get the root CAs from the SCM.