Append optional relax flag to (un)trusted root certificates

This makes our implementation more consistent with the implementation of
gpg-agent's MARKTRUSTED command which always appends " relax" to the
flag 'S'.

GnuPG-bug-id: 6096