Add missing Yubico intermediate certs

[timweri]

Adding missing old intermediate certs:

• YUBICO_FIDO_ROOT_CA_450203556

Adding missing new intermediate certs:

• YUBICO_FIDO_ATTESTATION_B2_1
• YUBICO_PIV_ATTESTATION_B2_1

[Copilot]

Copilot review overview

🟡 Changes recommended

The new security-sensitive trust paths lack end-to-end attestation fixtures.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2

Open (2)

• Add attestation fixtures for B2 and new FIDO root paths · New
• Add end-to-end B2 device intermediate verification fixture · New

What changed in this PR

Adds missing Yubico PIV/FIDO trust chains and refactors certificate-chain verification.

Changes:

• Adds B2 attestation certificates and a new FIDO root.
• Centralizes known chains and validates embedded certificates.
• Updates dependencies, crate version, and dependency-freshness CI.

File	Description
src/​yubikey/​verification.rs	Adds the PIV B2 chain and chain validation test.
src/​fido/​verification.rs	Adds FIDO B2/new-root trust paths and tests.
Cargo.toml	Bumps crate and der-parser versions.
Cargo.lock	Updates resolved dependencies.
.github/​workflows/​dependency-freshness.yml	Adds dependency-age checking.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The newly trusted certificate paths lack end-to-end attestation fixtures that verify the intended compatibility behavior.

Review effort: Balanced
Findings: 2

Open (2)

• Add end-to-end B2 device intermediate verification fixture
• Add attestation fixtures for B2 and new FIDO root paths

[Copilot]

Copilot review overview

🔵 Needs a closer look

Expanding trusted certificate material and adding a third-party CI action warrants final human provenance and security validation.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Add end-to-end B2 device intermediate verification fixture
• Add attestation fixtures for B2 and new FIDO root paths