Fix overclaiming resource errors

= Mention *which* resources are not held by parent
= Use an explicit error code and text for root certificates that use 'inherit'