Add option to GetPem to not include root CA

[mitchcapper]

I believe for certificate bundles including the root CA has no benefit (if the user already trusts it they have it and if not they won't trust it as they are not cross signed). General recommendation I believe is to not include it, but just an option to ToPem to not include it would suffice (rather than splitting them apart after).

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[mitchcapper]

still valid.