Add integration test for webpki-roots-shim error cases

[jahkeup]

...

Writing a small binary that can be used to test this as part of integration tests is probably a good idea.

Originally posted by @iliana in https://github.com/amazonlinux/PRIVATE-thar/pull/287