Perform CRLSet evaluation during Path Building on NSS

When using NSS for certificate verification, add CRLSet checking by
injecting a revocation callback function which will examine the
CRLSet and reject the certificate. If the CRLSet does not
affirmatively reject it, continue invoking the originally supplied
application callback (such as the ChromeOS callback) and allow it
an opportunity to reject.

Because of how NSS caches virtually everything, horribly so, this
restructures the unittests to no longer depend on how the underlying
library will select the path (since with NSS, it's fundamentally
non-determistic), and instead tests that as long as a singular
certificate path is still valid and un-revoked, it can be discovered.

BUG=589336
TEST=CertVerifyProcTest.CRLSet*

Review URL: https://codereview.chromium.org/1724413002

Cr-Commit-Position: refs/heads/master@{#379113}

0 files changed, 0 insertions, 0 deletions