widevine: Only enable Widevine CDM host verification for official builds

For non-official builds, typically Widevine signing certs are not
available. This CL updates `enable_widevine_cdm_host_verification` so
it's only set to true by default when `is_official_build` is true.

For developers enabling `is_official_build` and `is_chrome_branded`
locally without Widevine signing certs, the build may fail. In this case
simply set `enable_widevine_cdm_host_verification` to false to suppress
the error.

Bug: 1127616
Change-Id: I4256f8c53d79907eec23782300e223b4edb89d75
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2410311Reviewed-by: John Rummell <jrummell@chromium.org>
Reviewed-by: Michael Moss <mmoss@chromium.org>
Commit-Queue: Xiaohan Wang <xhwang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#806802}

third_party/widevine/cdm/widevine.gni

@@ -47,8 +47,17 @@ if (is_mac && target_cpu == "arm64") {
   bundle_widevine_cdm = false
 }
 
+declare_args() {
+# Enable Widevine CDM host verification, which will sign additional binaries
+# with Widevine certs and copy signature files as needed. Only enabled by
+# default on official bots. For developers building with "is_official_build"
+# locally without Widevine certs, this will cause a build failure, which can
+# be suppressed by manually setting `enable_widevine_cdm_host_verification` to
+# false.
 enable_widevine_cdm_host_verification =
     enable_library_widevine_cdm && enable_cdm_host_verification
+    && is_official_build
+}
 
 template("widevine_sign_file") {
   # For official builds, generate a signature file for |file| which will