Add missing VisibleSecurityState initialization

The |is_legacy_tls_control_site| member wasn't initialized in the
VisibleSecurityState constructor. This was causing an MSAN bot crash.

See activity on the previous CLs:
- https://crrev.com/c/1829462
- https://crrev.com/c/1832665
- https://crrev.com/c/1833172 (revert of 1829462)
- https://crrev.com/c/1833173 (revert of revert)

Bug: 989607
Change-Id: I1ee8627bbfec4839184ce041ce375d96855a4d88
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1836133Reviewed-by: Emily Stark <estark@chromium.org>
Commit-Queue: Christopher Thompson <cthomp@chromium.org>
Auto-Submit: Christopher Thompson <cthomp@chromium.org>
Cr-Commit-Position: refs/heads/master@{#702171}

components/security_state/core/security_state.cc

@@ -227,7 +227,8 @@ VisibleSecurityState::VisibleSecurityState()
       is_error_page(false),
       is_view_source(false),
       is_devtools(false),
-      connection_used_legacy_tls(false) {}
+      connection_used_legacy_tls(false),
+      is_legacy_tls_control_site(false) {}
 
 VisibleSecurityState::~VisibleSecurityState() {}