Write checks to avoid certain blacklist entries

[jcjones]

Copying from https://bugzilla.mozilla.org/show_bug.cgi?id=1249002#c3:

1. we could refuse to block the certificates that are listed in the preloaded
   pins to protect services.mozilla.com
   https://dxr.mozilla.org/mozilla-central/source/security/manager/tools/PreloadedHPKPins.json#74-81
   There are political implications to giving these root an unrevocable status.
   Those pins also expire after 6 weeks, so it's a footgun we could recover from.

2. we should add a special case for the Firefox PKI that we use to sign add-ons
   and content. That root must not be revocable through onecrl. If we ever need to
   replace it, we will most likely issue an update.