fix: verify the metadata database certificate with sslmode=verify-full

- Switch every `metadata_db_sslmode` passed to bincraft in `.crow/` and `local/` from `require` to `verify-full`.
- Pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` alongside `verify-full` in the scripts that call `DBI::dbConnect()` themselves, since libpq does not read the system trust store.
- Note in the README that the endpoint serves a Let's Encrypt certificate and how to verify it.

Part of rpkgs/bincraft#225.

local/repair-built-stamp.R

@@ -172,7 +172,7 @@ for (minor in r_minors) {
         metadata_db_port = 15432L,
         metadata_db_user = "rpkgs",
         metadata_db_password = Sys.getenv("PGPASS"),
-        metadata_db_sslmode = "require"
+        metadata_db_sslmode = "verify-full"
       )
       TRUE
     },