Verify root certificate is valid IACA certificate according to ISO 18013-5

We should verify the root cert is a valid IACA cert. I think for mDL this also requires a critical basicConstraint that requires that only end certificates are allowed under the root. This should be taken into account for verification.