verify: avoid modifying the cert list

We don't need to modify the list so let's avoid it to make it easier to
review.

Signed-off-by: Jussi Kukkonen <[email protected]>

Author: jku

sigstore/verify/verifier.py

@@ -135,10 +135,10 @@ def _verify_signed_timestamp(
 
             builder = (
                 VerifierBuilder()
-                .tsa_certificate(certificates.pop(0))
-                .add_root_certificate(certificates.pop())
+                .tsa_certificate(certificates[0])
+                .add_root_certificate(certificates[-1])
             )
-            for certificate in certificates:
+            for certificate in certificates[1, -1]:
                 builder = builder.add_intermediate_certificate(certificate)
 
             verifier = builder.build()