Make CA fetcher work with AIA extension even if the root CA was set explicitly

We may have a root certificate set by the application via setCaCertificates. Unfortunately, on Windows this suppresses the logic that can fetch a missing intermediate certificate (signed by the root that was set via setCaCertificates). Makes sense to relax this logic a bit, so we still try to fetch a certificate and check that the root we end up with is the one set via setCaCertificates.