fix: verify the metadata database certificate with sslmode=verify-full

- Switch every `metadata_db_sslmode` passed to bincraft in `.crow/` and `local/` from `require` to `verify-full`.
- Pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` alongside `verify-full` in the scripts that call `DBI::dbConnect()` themselves, since libpq does not read the system trust store.
- Note in the README that the endpoint serves a Let's Encrypt certificate and how to verify it.

Part of rpkgs/bincraft#225.

local/build-all.R

@@ -152,7 +152,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 # Scope the skip to the R minor this pass is running under. `single_builds`
 # records `r_version` per attempt, but querying without it made a non-primary
@@ -250,7 +251,7 @@ mapply(
       metadata_db_table = "single_builds",
       metadata_db_user = "rpkgs",
       metadata_db_password = Sys.getenv("PGPASS"),
-      metadata_db_sslmode = "require",
+      metadata_db_sslmode = "verify-full",
       metadata_db_port = 15432,
       archive = TRUE,
       patches = "local/patches",