Certificates for Lacros (MVP)

This allows Lacros-Chrome access to the system-wide TPM slot,
the per-user TPM slot, and per-user storage for certificates and
trust settings, for enterprise-managed devices where the logged-in
user is an affiliate of that enterprise.

Rather than Lacros-Chrome directly interacting with the login services,
it requests that Ash-Chrome notify it when the TPM and Cryptohome are
available, receiving the path to the per-user storage and the result
of TPM initialization. Lacros-Chrome can then initialize initialize a
connection to the TPM (via a PKCS#11 module) and initialize storage at
the path provided by Ash-Chrome.

For users that are not affiliated, Chrome today enables access to both
the per-user TPM and per-user storage. However, for Lacros-Chrome, this
is a known issue and not yet supported (crbug.com/1146430). This is
because loading the TPM unconditionally loads both the system and user
slot today, while non-affiliated users should not have access to the
system slot. The per-user storage will be loaded for all users with
this CL.

Similarly, using the system slot on the login screen is not yet
supported, and will be addressed in a follow-up (crbug.com/1146430).

Bug: 1145946
Change-Id: I2edc6e04c2de09f4c8a4d3bdca9c9ba5a9dee3fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2435642
Commit-Queue: Michael Ershov <miersh@google.com>
Reviewed-by: David Roger <droger@chromium.org>
Reviewed-by: Roland Bock <rbock@google.com>
Reviewed-by: Pavol Marko <pmarko@chromium.org>
Reviewed-by: Ryan Sleevi <rsleevi@chromium.org>
Reviewed-by: Erik Chen <erikchen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#832960}

• chrome/browser/BUILD.gn[diff]
• chrome/browser/chromeos/BUILD.gn[diff]
• chrome/browser/chromeos/crosapi/ash_chrome_service_impl.cc[diff]
• chrome/browser/chromeos/crosapi/ash_chrome_service_impl.h[diff]
• chrome/browser/chromeos/crosapi/browser_util.cc[diff]
• chrome/browser/chromeos/crosapi/cert_database_ash.cc[Added - diff]
• chrome/browser/chromeos/crosapi/cert_database_ash.h[Added - diff]
• chrome/browser/lacros/cert_db_initializer.cc[Added - diff]
• chrome/browser/lacros/cert_db_initializer.h[Added - diff]
• chrome/browser/lacros/cert_db_initializer_factory.cc[Added - diff]
• chrome/browser/lacros/cert_db_initializer_factory.h[Added - diff]
• chrome/browser/net/nss_context_linux.cc[diff]
• chrome/browser/net/profile_network_context_service.cc[diff]
• chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc[diff]
• chrome/browser/resources/settings/route.js[diff]
• chrome/browser/ssl/ssl_browsertest.cc[diff]
• chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc[diff]
• chrome/browser/ui/webui/settings/settings_ui.cc[diff]
• chrome/test/data/webui/settings/security_page_test.js[diff]
• chromeos/crosapi/mojom/BUILD.gn[diff]
• chromeos/crosapi/mojom/cert_database.mojom[Added - diff]
• chromeos/crosapi/mojom/crosapi.mojom[diff]
• chromeos/lacros/lacros_chrome_service_impl.cc[diff]
• chromeos/lacros/lacros_chrome_service_impl.h[diff]
• crypto/BUILD.gn[diff]
• crypto/chaps_support.cc[Added - diff]
• crypto/chaps_support.h[Added - diff]
• crypto/nss_util.cc[diff]
• crypto/nss_util_chromeos.cc[diff]
• crypto/nss_util_internal.h[diff]
• net/cert/nss_cert_database.cc[diff]