Add a ClientKeyStore to allow injection of non-platform keys for TLS client auth.

net/BUILD.gn

Index: net/BUILD.gn
diff --git a/net/BUILD.gn b/net/BUILD.gn
index 7da87e46e627f367dd5f59c601006fdbac7816f5..6621fef67a40f103157c4306f626055e00b08daf 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -266,7 +266,11 @@ component("net") {
       ]
     }
     if (use_nss_certs) {
-      sources -= [ "ssl/ssl_platform_key_nss.cc" ]
+      sources -= [
+        "ssl/client_key_store.cc",
+        "ssl/client_key_store.h",
+        "ssl/ssl_platform_key_nss.cc",
+      ]
     }
   }
 
@@ -355,7 +359,11 @@ component("net") {
         "ssl/client_cert_store_chromeos.h",
       ]
     }
-    sources -= [ "ssl/ssl_platform_key_nss.cc" ]
+    sources -= [
+      "ssl/client_key_store.cc",
+      "ssl/client_key_store.h",
+      "ssl/ssl_platform_key_nss.cc",
+    ]
   } else if (use_openssl) {
     # client_cert_store_nss.c requires NSS_CmpCertChainWCANames from NSS's
     # libssl, but our bundled copy is not built in OpenSSL ports. Pull that file