Add initial version of captive portal list checking.

chrome/browser/ssl/ssl_error_assistant.proto

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 syntax = "proto2";
 
 option optimize_for = LITE_RUNTIME;
 
 package chrome_browser_ssl;
 
 message CaptivePortalCert {
   // Sha256 hash of the certificate's public key. The fingerprint is prefixed
   // with "sha256/" and encoded in base64 (same format as
   // src/net/http/transport_security_state_static.pins)
   // Example: sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+  //
+  // NOTE: Only leaf certs must be added here.
   optional string sha256_hash = 1;
 }
 
 message SSLErrorAssistantConfig {
   optional uint32 version_id = 1;
   repeated CaptivePortalCert captive_portal_cert = 2;
 }