Add script for generating certificates that require an explicit policy

net/data/ssl/certificates/README

 This directory contains various certificates for use with SSL-related
 unit tests.
 
 - google.binary.p7b
 - google.chain.pem
 - google.pem_cert.p7b
 - google.pem_pkcs7.p7b
 - google.pkcs7.p7b
 - google.single.der
 - google.single.pem
 - thawte.single.pem : Certificates for testing parsing of different formats.
 
 - googlenew.chain.pem : The refreshed Google certificate
      (valid until Sept 30 2013).
 
 - mit.davidben.der : An expired MIT client certificate.
 
 - foaf.me.chromium-test-cert.der : A client certificate for a FOAF.ME identity
      created for testing.
 
 - www_us_army_mil_cert.der
 - dod_ca_17_cert.der
-- dod_root_ca_2_cert.der : A certificate chain for regression tests of
-     http://crbug.com/31497.
+- dod_root_ca_2_cert.der : 
+     A certificate chain used for testing certificate imports
 
 - unosoft_hu_cert : Certificate used by X509CertificateTest.UnoSoftCertParsing.
 
 - client.p12 : A PKCS #12 file containing a client certificate and a private
      key created for testing.  The password is "12345".
 
 - client-nokey.p12 : A PKCS #12 file containing a client certificate (the same
      as the one in client.p12) but no private key. The password is "12345".
 
 - punycodetest.der : A test self-signed server certificate with punycode name.
@@ skipping 177 matching lines @@
 - root_ca_cert.pem
      These certificates are the common certificates used by the Python test
      server for simulating HTTPS connections. They are generated by running
      the script net/data/ssl/scripts/generate-test-certs.sh.
 
 - quic_intermediate.crt
 - quic_test_ecc.example.com.crt
 - quic_test.example.com.crt
 - quic_root.crt
      These certificates are used by the ProofVerifier's unit tests of QUIC.
+
+- explicit-policy-chain.pem
+     A test certificate chain with requireExplicitPolicy field set on the
+     intermediate, with SkipCerts=0. This is used for regression testing
+     http://crbug.com/31497. It is generated by running the script
+     net/data/ssl/scripts/generate-policy-certs.sh
+