Describe the bug

When invoking the gh attestation trusted-root command, the --hostname and --tuf-url flag cannot be used together.

The --hostname flag is supposed to ensure that the tenant-specific trusted-root is returned. This works as-expected when the --tuf-url flag is omitted (defaulting to the default TUF repository), but doesn't NOT work when a --tuf-url value is supplied that points to a non-default TUF repository.

The following code should be replicated for the case where the --tuf-url flag is supplied:
https://github.com/cli/cli/blob/trunk/pkg/cmd/attestation/trustedroot/trustedroot.go#L141-L144