Add subcommand to refresh ROFL app trust root

Currently the only way to refresh the trust root is to do so manually by editing the `rofl.yaml` file. We should add a simple subcommand, e.g. `oasis rofl refresh-trust-root` which fetches the latest trust root and updates the `rofl.yaml` app manifest.