Support multiple FIDO MDS trust roots

NEWS

@@ -22,6 +22,27 @@ Changes:
   root cert in the trust path during a transition grace period before MDS
   migrates to a new trust root.
   See: https://github.com/Yubico/java-webauthn-server/issues/498
+* The internal format of the `FidoMetadataDownloader` trust root cache has
+  changed and is now opaque. This will invalidate the trust root cache and cause
+  a re-download of the trust root certificate.
+* The `FidoMetadataDownloader` trust root cache will now be invalidated and
+  cause a re-download if the set of trust root download URLs changes. Changing
+  the set of acceptable SHA-256 hashes does not directly invalidate the cache,
+  but may indirectly invalidate the cache unless each cached certificate matches
+  some of the given SHA-256 hashes.
+* Parameters `getCachedTrustRootCert` and `writeCachedTrustRootCert` in
+  `FidoMetadataDownloader` builder method `useTrustRootCache` renamed to
+  `getCachedTrustRootCerts` and `writeCachedTrustRootCerts` in JavaDoc.
+
+New features:
+
+* New `FidoMetadataDownloader` builder methods.
+  These enable trusting multiple trust roots, for example to ensure a smooth
+  transition when MDS migrates to a new trust root:
+ ** `downloadTrustRoots(List<URL>, Set<ByteArray>)` as alternative to
+    `downloadTrustRoot(URL, Set<ByteArray>)`
+ ** `useTrustRoots(Set<TrustAnchor>)` as alternative to
+    `useTrustRoot(X509Certificate)`
 
 
 == Version 2.9.0 ==

webauthn-server-attestation/src/integrationTest/scala/com/yubico/fido/metadata/FidoMetadataDownloaderIntegrationTest.scala

@@ -12,6 +12,7 @@ import org.scalatest.tags.Network
 import org.scalatest.tags.Slow
 import org.scalatestplus.junit.JUnitRunner
 
+import java.util.Collections
 import scala.jdk.CollectionConverters.ListHasAsScala
 
 @Slow
@@ -37,16 +38,25 @@ class FidoMetadataDownloaderIntegrationTest
       blob should not be null
       val trustRootCert =
         CertificateParser.parseDer(
-          TestCaches.trustRootCache.get.getBytes
+          com.yubico.internal.util.JacksonCodecs
+            .cbor()
+            .readValue(
+              TestCaches.trustRootCache.get.getBytes,
+              classOf[FidoMetadataDownloader.TrustRootsCacheValue],
+            )
+            .getCertsDer
+            .get(0)
         )
 
       val certChain = TestCaches
         .cacheSynchronized(
           downloader
             .fetchHeaderCertChain(
-              trustRootCert,
+              Collections.singleton(
+                FidoMetadataDownloader.importTrustAnchor(trustRootCert)
+              ),
               downloader
-                .parseBlob(TestCaches.blobCache.get)
+                .parseBlob(TestCaches.blobCache.get.getBytes)
                 .getBlob
                 .getHeader,
             )