Add parsing code for RFC 5280 PolicyConstraints.

net/cert/internal/parsed_certificate.h

Index: net/cert/internal/parsed_certificate.h
diff --git a/net/cert/internal/parsed_certificate.h b/net/cert/internal/parsed_certificate.h
index f078af1c03e8d6651ebc3a4568619fb6a7d17108..c55f17c115c445b71a05c1843c16ab7aaaf60ac5 100644
--- a/net/cert/internal/parsed_certificate.h
+++ b/net/cert/internal/parsed_certificate.h
@@ -11,6 +11,7 @@
 
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
+#include "net/cert/internal/certificate_policies.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/der/input.h"
 #include "third_party/boringssl/src/include/openssl/base.h"
@@ -197,6 +198,16 @@ class NET_EXPORT ParsedCertificate
     return policy_oids_;
   }
 
+  // Returns true if the certificate has a PolicyConstraints extension.
+  bool has_policy_constraints() const { return has_policy_constraints_; }
+
+  // Returns the ParsedPolicyConstraints struct. Caller must check
+  // has_policy_constraints() before accessing this.
+  const ParsedPolicyConstraints& policy_constraints() const {
+    DCHECK(has_policy_constraints_);
+    return policy_constraints_;
+  }
+
   // Returns a map of all the extensions in the certificate.
   const ExtensionsMap& extensions() const { return extensions_; }
 
@@ -273,6 +284,10 @@ class NET_EXPORT ParsedCertificate
   bool has_policy_oids_ = false;
   std::vector<der::Input> policy_oids_;
 
+  // Policy constraints extension.
+  bool has_policy_constraints_ = false;
+  ParsedPolicyConstraints policy_constraints_;
+
   // All of the extensions.
   ExtensionsMap extensions_;