Enable trust anchor constraints for the built-in Cast roots.

components/cast_certificate/cast_crl.cc

Index: components/cast_certificate/cast_crl.cc
diff --git a/components/cast_certificate/cast_crl.cc b/components/cast_certificate/cast_crl.cc
index e9233952d6a943d511cc38fcb57638699f1f6915..256623c867e751b005ef4498265656aedda9e2ba 100644
--- a/components/cast_certificate/cast_crl.cc
+++ b/components/cast_certificate/cast_crl.cc
@@ -67,10 +67,9 @@ class CastCRLTrustStore {
             kCastCRLRootCaDer, sizeof(kCastCRLRootCaDer),
             net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE, {});
     CHECK(cert);
-    // TODO(crbug.com/635200): Support anchor constraints, and initialize the
-    // anchor using constraints from the self-signed certificate.
+    // Enforce pathlen constraints and policies defined on the root certificate.
     scoped_refptr<net::TrustAnchor> anchor =
-        net::TrustAnchor::CreateFromCertificateNoConstraints(std::move(cert));
+        net::TrustAnchor::CreateFromCertificateWithConstraints(std::move(cert));
     CHECK(anchor);
     store_.AddTrustAnchor(std::move(anchor));
   }