Support trust anchor constraints, by specifying them as a certificate.

net/cert/internal/trust_store.cc

Index: net/cert/internal/trust_store.cc
diff --git a/net/cert/internal/trust_store.cc b/net/cert/internal/trust_store.cc
index 65cb840b692b608dd02b0d2135a08567b7320b0c..726806b3f6abd9d6683ebf915696ab78c3ae9061 100644
--- a/net/cert/internal/trust_store.cc
+++ b/net/cert/internal/trust_store.cc
@@ -10,7 +10,12 @@ namespace net {
 
 scoped_refptr<TrustAnchor> TrustAnchor::CreateFromCertificateNoConstraints(
     scoped_refptr<ParsedCertificate> cert) {
-  return scoped_refptr<TrustAnchor>(new TrustAnchor(std::move(cert)));
+  return scoped_refptr<TrustAnchor>(new TrustAnchor(std::move(cert), false));
+}
+
+scoped_refptr<TrustAnchor> TrustAnchor::CreateFromCertificateWithConstraints(
+    scoped_refptr<ParsedCertificate> cert) {
+  return scoped_refptr<TrustAnchor>(new TrustAnchor(std::move(cert), true));
 }
 
 der::Input TrustAnchor::spki() const {
@@ -25,8 +30,9 @@ const scoped_refptr<ParsedCertificate>& TrustAnchor::cert() const {
   return cert_;
 }
 
-TrustAnchor::TrustAnchor(scoped_refptr<ParsedCertificate> cert)
-    : cert_(std::move(cert)) {
+TrustAnchor::TrustAnchor(scoped_refptr<ParsedCertificate> cert,
+                         bool enforces_constraints)
+    : cert_(std::move(cert)), enforces_constraints_(enforces_constraints) {
   DCHECK(cert_);
 }