Add hardware_backed_root, root_issued_leaves health checks

[cipherboy]

This is based on top of #17750; will be rebased once that merges.

We add two new health checks in this one:

• hardware_backed_root, defaulting to disabled, which checks whether Root CAs are backed by the Managed Key subsystem.
• root_issued_leaves, which checks whether the root has directly issued leaf certificates.

We also update the list to also show the configuration for that health check, and fix table listing to be in a static order.

[stevendpclark]

lgtm

[cipherboy]

Thanks! Merging, I'll address the semgrep problem in a subsequent PR.