Add initial version of captive portal list checking.

chrome/browser/ssl/ssl_error_assistant.proto

Index: chrome/browser/ssl/ssl_error_assistant.proto
diff --git a/chrome/browser/ssl/ssl_error_assistant.proto b/chrome/browser/ssl/ssl_error_assistant.proto
index ca64528e6513cbf1932f595146c457452f5947ee..ba05957cf11a3edc19dab714a9360b1eb65cd0a5 100644
--- a/chrome/browser/ssl/ssl_error_assistant.proto
+++ b/chrome/browser/ssl/ssl_error_assistant.proto
@@ -13,6 +13,8 @@ message CaptivePortalCert {
   // with "sha256/" and encoded in base64 (same format as
   // src/net/http/transport_security_state_static.pins)
   // Example: sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+  //
+  // NOTE: Only leaf certs must be added here.

[Ryan Sleevi, 2017/02/01 22:06:06]

When I read this outloud, it sounds weird, but it may be totally valid.

Alternative wordings might be

NOTE: Only leaf certificates are supported.
NOTE: Certificates other than leaf certificates are not supported.

Basically, I'm trying to parse the "must" here, to understand what happens if
that must is violated (e.g. does it crash or is it just not supported)

[meacer, 2017/02/02 01:56:05]

Technically intermediates and roots can also be added, and they will trigger a
captive portal interstitial. The warning was to discourage doing that, but since
it's also not an invalid thing to do not sure if unsupported is the right word
-- it seems possible to me that a captive portal vendor owns an intermediate and
that we decide to add it here?

   optional string sha256_hash = 1;
 }