Resolve trust anchors

Resolves the trust anchors that apply to a trust decision. A caller can pass a domainId to resolve an explicit domain or pass a purpose and optional target so the resolver selects the best matching binding. By default, only active domains and active anchors are returned.