Implement support for additional trust anchors on Windows.

There seems to be no way to pass these through the Windows API, so we check the list manually when validation returns an untrusted root and skip the policy checks if a custom root is found.
Required for rogerwang/node-webkit#2561