add custodians to root message

In some cases, it might make sense for the root message to contain the identities of custodians.

This is not needed if we already have some other record of the outgoing shard messages.

This is a repeated property - which in protobuf means 0 or more - meaning it is optional. So adding this property does not break any functionality we currently have.

I have the feeling we might want this for our Briar Proof-of-concept if we use the root message as the sole record of the backup