Add new SecurityLevel for Http Bad state

components/security_state/security_state_model.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_SECURITY_STATE_SECURITY_STATE_MODEL_H_
 #define COMPONENTS_SECURITY_STATE_SECURITY_STATE_MODEL_H_
 
 #include <stdint.h>
 
 #include "base/macros.h"
@@ skipping 21 matching lines @@
   // If you reorder, add, or delete values from this enum, you must also
   // update the UI icons in ToolbarModelImpl::GetIconForSecurityLevel.
   //
   // A Java counterpart will be generated for this enum.
   // GENERATED_JAVA_ENUM_PACKAGE: org.chromium.components.security_state
   // GENERATED_JAVA_CLASS_NAME_OVERRIDE: ConnectionSecurityLevel
   enum SecurityLevel {
     // HTTP/no URL/HTTPS but with insecure passive content on the page.
     NONE,
 
+    // HTTP, but something about the page (e.g., inclusion of private info)
+    // suggests we should show a warning for it. This is intended for use as
+    // part of the Http Bad rollout (https://crbug.com/647754).

[Peter Kasting, 2016/09/20 00:50:05]

OK... I'm still not really sure how this comment is helpful to me as a reader,
or how we're going to know to come back here and remove that at some point. 
When is this no longer applicable?  Clearly in ten years when this is fully
rolled out we won't need/want this comment, but what's the point before then
where it becomes useless?

What about something like this?

    // HTTP, in a case where we want to show a visible warning about the page's
    // lack of security.
    //
    // The criteria used to classify pages as NONE vs. HTTP_WARNING will change
    // over time.  Eventually, NONE Will be eliminated.  See crbug.com/647754.

[felt, 2016/09/20 01:09:56]

Done.

+    HTTP_WARNING,
+
     // HTTPS with valid EV cert.
     EV_SECURE,
 
     // HTTPS (non-EV) with valid cert.
     SECURE,
 
     // HTTPS, but with an outdated protocol version.
     SECURITY_WARNING,
 
     // HTTPS, but the certificate verification chain is anchored on a
@@ skipping 143 matching lines @@
   mutable VisibleSecurityState visible_security_state_;
 
   SecurityStateModelClient* client_;
 
   DISALLOW_COPY_AND_ASSIGN(SecurityStateModel);
 };
 
 }  // namespace security_state
 
 #endif  // COMPONENTS_SECURITY_STATE_SECURITY_STATE_MODEL_H_