Add generated PKITS tests relating to certificate policies.

net/cert/internal/verify_certificate_chain_pkits_unittest.cc

Index: net/cert/internal/verify_certificate_chain_pkits_unittest.cc
diff --git a/net/cert/internal/verify_certificate_chain_pkits_unittest.cc b/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
index 2039a60d28afe2b3b5c34e9f229dfafe7fa5825a..8c16a3a6edb3d5b06fa6b5c96ba69be43d6af13f 100644
--- a/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
+++ b/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
@@ -48,14 +48,16 @@ namespace {
 class VerifyCertificateChainPkitsTestDelegate {
  public:
   static bool Verify(std::vector<std::string> cert_ders,
-                     std::vector<std::string> crl_ders) {
+                     std::vector<std::string> crl_ders,
+                     const PkitsTestSettings& settings) {
     if (cert_ders.empty()) {
       ADD_FAILURE() << "cert_ders is empty";
       return false;
     }
 
-    // PKITS lists chains from trust anchor to target, VerifyCertificateChain
-    // takes them starting with the target and not including the trust anchor.
+    // PKITS lists chains from trust anchor to target, whereas
+    // VerifyCertificateChain takes them starting with the target and ending
+    // with the trust anchor.
     std::vector<scoped_refptr<net::ParsedCertificate>> input_chain;
     CertErrors parsing_errors;
     for (auto i = cert_ders.rbegin(); i != cert_ders.rend(); ++i) {
@@ -97,7 +99,7 @@ TEST_F(PkitsTest01SignatureVerificationCustom,
                                "ValidDSASignaturesTest4EE"};
   const char* const crls[] = {"TrustAnchorRootCRL", "DSACACRL"};
   // DSA signatures are intentionally unsupported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 // Modified version of 4.1.5 Valid DSA Parameter Inheritance Test5
@@ -109,7 +111,7 @@ TEST_F(PkitsTest01SignatureVerificationCustom,
   const char* const crls[] = {"TrustAnchorRootCRL", "DSACACRL",
                               "DSAParametersInheritedCACRL"};
   // DSA signatures are intentionally unsupported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 class PkitsTest13SignatureVerificationCustom
@@ -124,7 +126,7 @@ TEST_F(PkitsTest13SignatureVerificationCustom,
   const char* const crls[] = {"TrustAnchorRootCRL",
                               "nameConstraintsRFC822CA1CRL"};
   // Name constraints on rfc822Names are not supported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 // Modified version of 4.13.23 Valid RFC822 nameConstraints Test23
@@ -136,7 +138,7 @@ TEST_F(PkitsTest13SignatureVerificationCustom,
   const char* const crls[] = {"TrustAnchorRootCRL",
                               "nameConstraintsRFC822CA2CRL"};
   // Name constraints on rfc822Names are not supported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 // Modified version of 4.13.25 Valid RFC822 nameConstraints Test25
@@ -148,7 +150,7 @@ TEST_F(PkitsTest13SignatureVerificationCustom,
   const char* const crls[] = {"TrustAnchorRootCRL",
                               "nameConstraintsRFC822CA3CRL"};
   // Name constraints on rfc822Names are not supported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 // Modified version of 4.13.27 Valid DN and RFC822 nameConstraints Test27
@@ -161,7 +163,7 @@ TEST_F(PkitsTest13SignatureVerificationCustom,
   const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsDN1CACRL",
                               "nameConstraintsDN1subCA3CRL"};
   // Name constraints on rfc822Names are not supported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 // Modified version of 4.13.34 Valid URI nameConstraints Test34
@@ -172,7 +174,7 @@ TEST_F(PkitsTest13SignatureVerificationCustom,
                                "ValidURInameConstraintsTest34EE"};
   const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsURI1CACRL"};
   // Name constraints on uniformResourceIdentifiers are not supported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 // Modified version of 4.13.36 Valid URI nameConstraints Test36
@@ -183,7 +185,7 @@ TEST_F(PkitsTest13SignatureVerificationCustom,
                                "ValidURInameConstraintsTest36EE"};
   const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsURI2CACRL"};
   // Name constraints on uniformResourceIdentifiers are not supported.
-  ASSERT_FALSE(this->Verify(certs, crls));
+  ASSERT_FALSE(this->Verify(certs, crls, {}));
 }
 
 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain,