Better adhere to the Get rule with SecTrustGetCertificateAtIndex

The Get rule [1] says that, if unretained, objects returned from Get
functions may be released when the owning object changes.
Although historically SecTrustGetCertificateAtIndex has not caused
mutation to the SecTrust, it is allowed to. Defensively pass
SecCertificateRef around as CFTypeRef<SecCertificateRef>, so we
make fewer assumptions on SecTrust methods.

If SecTrustGetCertificateAtIndex causes a re-evaluation, this can
block the calling thread, and potentially result in a confusing
chain in which one or more of the certs were from the 'first'
validation and one or more are from the 'second' validation, but
this is otherwise unavoidable, because there's not a one-shot API
to get the entire chain.

[1] https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFMemoryMgmt/Concepts/Ownership.html

Bug: 1180744
Change-Id: I4d8e5ccfe135c7d1a4a5c619451817d7fef28ae1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2717659
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Rohit Rao <rohitrao@chromium.org>
Reviewed-by: Justin Cohen <justincohen@chromium.org>
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#857810}

• ios/web/navigation/crw_wk_navigation_handler.mm[diff]
• ios/web/security/crw_cert_verification_controller.mm[diff]
• ios/web/security/wk_web_view_security_util.mm[diff]
• net/cert/cert_verify_proc_ios.cc[diff]
• net/cert/cert_verify_proc_mac.cc[diff]
• net/cert/x509_util_ios.cc[diff]
• net/cert/x509_util_ios.h[diff]
• net/cert/x509_util_ios_and_mac_unittest.cc[diff]
• net/cert/x509_util_mac.cc[diff]
• net/cert/x509_util_mac.h[diff]
• net/ssl/client_cert_store_mac.cc[diff]