MD Settings: Fix networking config errors

components/onc/docs/onc_spec.md

 # Open Network Configuration
 
 [TOC]
 
 ## Objective
 
 We would like to create a simple, open, but complete format to describe
 multiple network configurations for WiFi, Ethernet, Cellular,
 Bluetooth/WiFi-Direct, and VPN connections in a single file format, in order
 to simplify and automate network configuration for users.
@@ skipping 1067 matching lines @@
     * Password of user. If not specified, defaults to prompting the user.
 
 * **SaveCredentials**
     * (optional, defaults to *false*) - **boolean**
     * If *false*, require user to enter credentials
       each time they connect. Specifying **Identity**
       and/or **Password** when
       **SaveCredentials** is
       *false* is not allowed.
 
+* **ServerCAPEMs**
+    * (optional) - **array of string**
+    * Non-empty list of CA certificates in PEM format, If this field is set,
+      **ServerCARef** and **ServerCARefs** must be unset.

[tbarzic, 2017/04/24 23:32:43]

(very minor) nit: imho "must not be set" sounds better than "must be unset", but
up to you

[stevenjb, 2017/04/25 00:00:52]

I was being consistent with other comments. We can clean this up separately,
because I agree.

[tbarzic, 2017/04/25 00:08:36]

ok, sgtm

+
 * **ServerCARefs**
     * (optional) - **array of string**
     * Non-empty list of references to CA certificates in **Certificates** to be
       used for verifying the host's certificate chain. At least one of the CA
       certificates must match. If this field is set, **ServerCARef** must be
       unset. If neither **ServerCARefs** nor **ServerCARef** is set, the client
       does not check that the server certificate is signed by a specific CA.
       A verification using the system's CA certificates may still apply.
       See **UseSystemCAs** for this.
 
@@ skipping 703 matching lines @@
 is transmitted or saved to disk should be secure. On client device, when
 user names for connections that are user-specific are persisted to disk,
 they should be stored in a location that is encrypted. Users can also opt in
 these cases to not save their user credentials in the config file and will
 instead be prompted when they are needed.
 
 ## Authors
 
 * pneubeck@chromium.org
 * stevenjb@chromium.org