Raise VerificationError when the trusted root has no tlogs

[theadsingh]

Verifier.__init__ reads trusted_root._inner.tlogs[0].base_url to pick a Rekor
instance. If the trusted root carries no transparency log instances, that indexes an
empty list and the caller gets a bare IndexError, which is not part of the documented
surface:

url = trusted_root._inner.tlogs[0].base_url
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
IndexError: list index out of range

This raises VerificationError instead, so a caller catching the documented exception
type sees it. Same shape as the checkpoint fix in #1826.

Worth noting the empty-tlog case is only reachable with the certificate authorities
still populated: get_fulcio_certs() runs one line earlier and already raises
MetadataError for a trusted root that is empty across the board. My first attempt at a
reproducer blanked everything and never reached the tlog lookup at all, so the test
keeps the CAs intact and asserts that before exercising the constructor.

I have not changed TrustedRoot._verify(), which felt like the other candidate spot.
Rejecting tlog-less roots at construction would also affect paths that never touch
Rekor, and I could not convince myself that was safe, so this stays scoped to the
verifier. Happy to move it if you would rather the validation lived there.

Closes #1822