Add certificate pinning check for anchor HTTPS endpoints in AnchorVerifier

[Kingsman-99]

Description

AnchorVerifier validates anchor metadata but does not verify TLS certificate pinning for anchor HTTPS endpoints. A compromised DNS or CA can redirect anchor requests to a malicious server.

Acceptance Criteria

• AnchorVerifierOptions gains an optional pinnedCertFingerprints?: Record<string, string> (domain to SHA-256 fingerprint)
• When a fingerprint is configured for a domain, the verifier checks the server certificate fingerprint before trusting the response
• A fingerprint mismatch throws a CertificatePinningError naming the domain
• Unit tests pass

Context

• Target file: src/anchors/AnchorVerifier.ts
• Fingerprint format: colon-separated uppercase hex pairs (standard openssl format)