Increase certificate flexibility

[adventureisyou]

Hi! Thanks for the neat package. Everything works well for me, but when digging into the code I have discovered two assumptions that I think aren't valid (and would cause things to stop working if Apple changed some stuff under the hood).

1. It is assumed that the list of certificates in the JWS header x5c field will always be of length 3.
   • I don't think there's any reason to assume this is the case; the chain could be as short or as long as they want.
   • This PR attempts to solve this issue by continuing to use the first certificate in the list as the leaf cert, but considering all others that follow as intermediate certs when calling leafCert.Verify().
2. It is assumed that the certificate chain included in the JWS will always be signed by Apple CA-G3.
   • This contradicts advice given here: https://forums.developer.apple.com/forums/thread/742185
   • This PR adds the ability to specify your own trusted certificate pool.
   • I've retained the old behaviour by defaulting to using a pool of only the Apple CA-G3 cert if the new config option is left nil.
   • My suggested usage of this is to pass in the cert pool created by https://github.com/devsisters/go-applereceipt/tree/master/applepki - Potentially we should fork that and use it?

I also snuck in a few performance improvements:

• Build the default cert pool once at creation, rather than on every verification.
• Deduplicate the work done on parsing certs from the header.

I have run the tests locally using my own keys etc and everything still passes.

[richzw]

LGTM

Thank you for your PR

[richzw]

@adventureisyou Thank you very much for your PR and solved the hard code cert of Apple CA-G3, this issue I've always wanted to solve but haven't solved.

My suggested usage of this is to pass in the cert pool created by https://github.com/devsisters/go-applereceipt/tree/master/applepki - Potentially we should fork that and use it?

Thank you for the good package to retrieve the certs. It is a good idea to fork and use it.