Resolve certificate references in ONC by PEM.

chrome/test/data/chromeos/net/shill_for_managed_toplevel2.json

 {
   "{77db0089-0bc8-4358-929c-123xcv}": {
     "EAP.EAP": "TLS",
     "EAP.Identity": "madmax@my.domain.com",
     "EAP.UseSystemCAs": true,
     "GUID": "{77db0089-0bc8-4358-929c-123xcv}",
     "Mode": "managed",
     "Profile": "user",
     "ProxyConfig": "{\"mode\":\"pac_script\",\"pac_mandatory\":false,\"pac_url\":\"https://proxycfg.my.domain.com/proxy.dat\"}",
     "SSID": "SomeWifi-XY",
     "SaveCredentials": true,
     "Security": "802_1x",
     "Type": "wifi",
-    "UIData": "{\"certificate_pattern\":{\"EnrollmentURI\":[\"chrome-extension://delkjfjibodjclmdijflfnimdmgdagfk/generate-cert.html\"],\"IssuerCARef\":[\"{58ac1967-a0e7-49e9-be68-123abc}\",\"{42cb13cd-140c-4941-9fb6-456def}\"]},\"certificate_type\":\"pattern\",\"onc_source\":\"user_policy\"}"
+    "UIData": "{\"certificate_pattern\":{\"EnrollmentURI\":[\"chrome-extension://delkjfjibodjclmdijflfnimdmgdagfk/generate-cert.html\"],\"IssuerCAPEMs\":[\"pem1\",\"pem2\"]},\"certificate_type\":\"pattern\",\"onc_source\":\"user_policy\"}"
   },
   "{a3860e83-f03d-4cb1-bafa-789oij}": {
     "GUID": "{a3860e83-f03d-4cb1-bafa-789oij}",
     "Name": "SomeVPN-XZ",
     "OpenVPN.AuthRetry": "interact",
 // Not needed by Shill.
 //    "OpenVPN.AuthUserPass": "",
-    "OpenVPN.CACertNSS": "{14ff4d51-64c1-4c86-a622-054dxyz}",
+    "OpenVPN.CACertPEM": [ "pem1", "pem2" ],
     "OpenVPN.CompLZO": "true",
     "OpenVPN.KeyDirection": "1",
 // Ignored by Shill.
 //    "OpenVPN.Mgmt.Enable": "",
     "OpenVPN.Port": "543",
     "OpenVPN.Proto": "udp",
     "OpenVPN.PushPeerInfo": "true",
     "OpenVPN.RemoteCertEKU": "TLS Web Server Authentication",
     "OpenVPN.RemoteCertKU": "e0",
     "OpenVPN.RemoteCertTLS": "server",
     "OpenVPN.RenegSec": "0",
     "OpenVPN.ServerPollTimeout": "13",
     "OpenVPN.StaticChallenge": "Please enter token",
     "OpenVPN.TLSAuthContents": "-----BEGIN OpenVPN Static key V1-----\n83f8e7ccd99be189b4663e18615f9166\nd885cdea6c8accb0ebf5be304f0b8081\n5404f2a6574e029815d7a2fb65b83d0c\n676850714c6a56b23415a78e06aad6b1\n34900dd512049598382039e4816cb5ff\n1848532b71af47578c9b4a14b5bca49f\n99e0ae4dae2f4e5eadfea374aeb8fb1e\na6fdf02adc73ea778dfd43d64bf7bc75\n7779d629498f8c2fbfd32812bfdf6df7\n8cebafafef3e5496cb13202274f2768a\n1959bc53d67a70945c4c8c6f34b63327\nfb60dc84990ffec1243461e0b6310f61\ne90aee1f11fb6292d6f5fcd7cd508aab\n50d80f9963589c148cb4b933ec86128d\ned77d3fad6005b62f36369e2319f52bd\n09c6d2e52cce2362a05009dc29b6b39a\n-----END OpenVPN Static key V1-----\n",
     "OpenVPN.TLSRemote": "my.domain.com",
     "OpenVPN.User": "madmax",
     "Profile": "user",
     "Provider.Host": "vpn.my.domain.com",
     "Provider.Type": "openvpn",
     "ProxyConfig": "{\"mode\":\"pac_script\",\"pac_mandatory\":false,\"pac_url\":\"http://proxycfg.my.domain/proxy.dat\"}",
     "SaveCredentials": false,
     "Type": "vpn",
-    "UIData": "{\"certificate_pattern\":{\"EnrollmentURI\":[\"chrome-extension://deicdjjibodjclmdijflfnimdmgdagfk/keygen-cert.html\"],\"IssuerCARef\":[\"{58ac1967-a0e7-49e9-be68-eb44b8827bcc}\",\"{42cb13cd-140c-4941-9fb6-0824ea2fde17}\"]},\"certificate_type\":\"pattern\",\"onc_source\":\"user_policy\"}"
+    "UIData": "{\"certificate_pattern\":{\"EnrollmentURI\":[\"chrome-extension://deicdjjibodjclmdijflfnimdmgdagfk/keygen-cert.html\"],\"IssuerCAPEMs\":[\"pem3\",\"pem4\"]},\"certificate_type\":\"pattern\",\"onc_source\":\"user_policy\"}"
 // Ignored by Shill.
 //    "VPN.Domain": ""
   }
 }