Add a ClientKeyStore to allow injection of non-platform keys for TLS client auth.

net/BUILD.gn

Index: net/BUILD.gn
diff --git a/net/BUILD.gn b/net/BUILD.gn
index 823d8698f207d3cfc581bd878edf3bd7fc3fd6f9..585b47b52140a29f5ea5dc1a6fccce22f36badf4 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -266,7 +266,11 @@ component("net") {
       ]
     }
     if (use_nss_certs) {
-      sources -= [ "ssl/ssl_platform_key_nss.cc" ]
+      sources -= [
+        "ssl/client_key_store.cc",
+        "ssl/client_key_store.h",
+        "ssl/ssl_platform_key_nss.cc",
+      ]
     }
   }
 
@@ -355,7 +359,11 @@ component("net") {
         "ssl/client_cert_store_chromeos.h",
       ]
     }
-    sources -= [ "ssl/ssl_platform_key_nss.cc" ]
+    sources -= [
+      "ssl/client_key_store.cc",
+      "ssl/client_key_store.h",
+      "ssl/ssl_platform_key_nss.cc",
+    ]
   } else if (use_openssl) {
     # client_cert_store_nss.c requires NSS_CmpCertChainWCANames from NSS's
     # libssl, but our bundled copy is not built in OpenSSL ports. Pull that file