Roll NSS from 253292:254867

DEPS

 # This file is automatically processed to create .DEPS.git which is the file
 # that gclient uses under git.
 #
 # See http://code.google.com/p/chromium/wiki/UsingGit
 #
 # To test manually, run:
 #   python tools/deps2git/deps2git.py -o .DEPS.git
 #   gclient runhooks
 # DO NOT CHECK IN CHANGES TO .DEPS.git. It will be automatically updated by
 # a bot when you modify this one.
@@ skipping 38 matching lines @@
   "skia_hash": "3b987595293de5a6fadd0f7c8c00eaedf5aca660",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and V8 without interference from each other.
   "v8_revision": "19644",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling WebRTC
   # and V8 without interference from each other.
   "webrtc_revision": "5619",
   "jsoncpp_revision": "248",
-  "nss_revision": "253292",
+  "nss_revision": "254867",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
   "swarming_revision": "dd806d645e711260c24bf7a2f061d6db091c3715",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openssl
   # and whatever else without interference from each other.
   "openssl_revision": "253925",
 }
 
@@ skipping 682 matching lines @@
                 "-s", "src/build/linux/bin/eu-strip.sha1",
     ],
   },
   {
     # A change to a .gyp, .gypi, or to GYP itself should run the generator.
     "name": "gyp",
     "pattern": ".",
     "action": ["python", "src/build/gyp_chromium"],
   },
 ]