Revert of Replaced cc::SurfaceId::nonce_ with base::UnguessableToken

cc/surfaces/surface_id.h

Index: cc/surfaces/surface_id.h
diff --git a/cc/surfaces/surface_id.h b/cc/surfaces/surface_id.h
index aa6c9c5d667fe420743e97585f796378b165076f..ae16b232bfbc7c5f1332daf1a8c88e29ac29befb 100644
--- a/cc/surfaces/surface_id.h
+++ b/cc/surfaces/surface_id.h
@@ -25,13 +25,17 @@
 
   constexpr SurfaceId(const SurfaceId& other) = default;
 
-  // A SurfaceId consists of two components: FrameSinkId and LocalFrameId.
+  // A SurfaceId consists of three components: FrameSinkId, local Id, and nonce.
   // A |frame_sink_id| consists of two components; one is allocated by the
   // display compositor service and one is allocated by the client. The
   // |frame_sink_id| uniquely identifies a FrameSink (and frame source).
-  // A |local_frame_id| is a sequentially allocated ID generated by the frame
-  // source that uniquely identifies a sequential set of frames of the same size
-  // and device scale factor.
+  // A |local_id| is a sequentially allocated ID generated by the frame source
+  // that uniquely identifies a sequential set of frames of the same size and
+  // device scale factor.
+  // A |nonce| is a cryptographically secure unguessable token that makes it
+  // impossible for an unprivileged frame source to embed another frame source
+  // without being explicitly given the surface ID of that frame source from a
+  // privileged process.
   constexpr SurfaceId(const FrameSinkId& frame_sink_id,
                       const LocalFrameId& local_frame_id)
       : frame_sink_id_(frame_sink_id), local_frame_id_(local_frame_id) {}