GitLab

Our previous logic would only check the common name of the certificate
to use for third party auth.  If someone wanted to use a cert which
specified O or OU instead of CN, then that certificate could not be
targeted via our Chrome Policy i.e.
RemoteAccessHostTokenValidationCertificateIssuer.

The new helper function will return the first valid field (in order):
CN, O, OU.  Our cert selection code will still favor CN so there won't
be any compat issues.

Change-Id: I2e1ea37f794c407e3b62afe87cf774976f283e55
Reviewed-on: https://chromium-review.googlesource.com/c/1323805
Commit-Queue: Joe Downing <joedow@chromium.org>
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#606218}