trust anchors: support non-root TAs, one domain per file

function `add_file` is added as an alias to `config`,
but otherwise the interface is almost identical.
3 jobs for <span class="ref-name">5011-nonroot</span> in 1 minute and 12 seconds
Status Job ID Name Coverage
  Build
passed #5680
docker linux amd64
build:linux:amd64

00:00:34

 
  Test
passed #5682
docker linux amd64
deckard:linux:amd64

00:00:37

passed #5681
docker linux amd64
test:linux:amd64

00:00:30