Add --ignore-certificate-errors-spki-list switch and UMA histogram.

content/public/common/content_switches.cc

Index: content/public/common/content_switches.cc
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index 313f2fae584c13f37ed5ed5010bfed47debc5832..11df20543e90aaf7ef770b474c13e015afc8417d 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -583,6 +583,17 @@ const char kGpuStartupDialog[]              = "gpu-startup-dialog";
 // Ignores certificate-related errors.
 const char kIgnoreCertificateErrors[]       = "ignore-certificate-errors";
 
+// A set of certificates by public key hash for which to ignore

[Ryan Sleevi, 2017/03/16 23:19:13]

I think this may either be missing a word (certificates _identified_ by public
key hash?) or may just be better with fewer words (A set of public key hashes
...)

[martinkr, 2017/03/28 23:16:02]

Done.

+// certificate-related errors. If an SSL certificates presented by the server
+// (leaf or intermediate) matches a public key from this list, certificate

[Ryan Sleevi, 2017/03/16 23:19:13]

Grammar: an SSL certificates mismatches plurality

But I'm wondering if this might be simpler as

// If the certificate chain presented by the server does not validate,
// and one or more certificates have public key hashes that match a
// key from this list, the error is ignored.

?

[martinkr, 2017/03/28 23:16:02]

Done.

+// errors are ignored.
+//
+// The switch value must be a comma-separated list of base64-encoded SHA-256
+// hashes of the DER-encoded certificate subject public keys (without tag and
+// length).

[Ryan Sleevi, 2017/03/16 23:19:13]

// The switch value is comprised of a comma-separated list of
// RFC 7469 pin-directives (e.g. pin-sha256=abcdef)

Alternatively, you could say:

// The switch value must a be a comma-separated list of Base64-encoded
// SHA-256 SPKI Fingerprints (RFC 7469, Section 2.4).

[martinkr, 2017/03/28 23:16:02]

Done.

+const char kIgnoreCertificateErrorsSPKIList[] =
+    "ignore-certificate-errors-spki-list";
+
 // Don't allow content to arbitrarily append to the back/forward list.
 // The page must prcoess a user gesture before an entry can be added.
 const char kHistoryEntryRequiresUserGesture[] =