Update the set of well-known roots

This updates the root stores for the 2018-01 update from Microsoft,
the macOS 10.13.0, 10.13.1, and 10.13.2 releases, the NSS CKBI 2.20
root store (part of NSS 3.35), and Android Oreo MR1.

This also introduces the concept of a 'legacy' SPKI, which is an SPKI
that is not trusted in the current Android or ChromiumOS root store.
This can be used to set more permissive policies for legacy Enterprises
that have relied on certain CAs being publicly trusted, despite not
adhering to the expectations of a publicly trusted CA.

BUG=none

Change-Id: Id2b358f1e46503deceaf9cd83256c8cd53ffe556
Reviewed-on: https://chromium-review.googlesource.com/990496Reviewed-by: David Benjamin <davidben@chromium.org>
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547805}

net/cert/root_cert_list_generated.h

@@ -2529,6 +2529,12 @@ const struct RootCertData {
          0x15, 0x61, 0x2E, 0xEE, 0x66, 0x29, 0xF2, 0x6F, 0xBC, 0xD7,
      },
      41},
+    {{
+         0xCB, 0xAD, 0x7B, 0x1D, 0x38, 0x48, 0x49, 0xDF, 0x09, 0x46, 0xB7,
+         0xEE, 0x8E, 0x7F, 0x5F, 0x7C, 0xE3, 0xAE, 0xD8, 0x76, 0xFD, 0xA7,
+         0xBC, 0x9D, 0x30, 0xD8, 0xB1, 0x6F, 0x29, 0xFF, 0x2C, 0x53,
+     },
+     492},
     {{
          0xCB, 0xE5, 0xAC, 0x15, 0xD8, 0x8B, 0x5C, 0xAC, 0x3F, 0x81, 0xE6,
          0xDF, 0x3B, 0xFB, 0x57, 0xBE, 0xA6, 0x09, 0x58, 0x81, 0x3A, 0x47,
@@ -2607,6 +2613,12 @@ const struct RootCertData {
          0xF9, 0xFA, 0x8D, 0x3D, 0x4D, 0x91, 0x69, 0x00, 0x28, 0x6B,
      },
      472},
+    {{
+         0xD4, 0x9C, 0x6F, 0x28, 0x9C, 0xD0, 0x56, 0x51, 0x94, 0x92, 0x48,
+         0x0F, 0x19, 0x2F, 0x00, 0xA6, 0xFC, 0x7C, 0x18, 0x62, 0xDA, 0xB2,
+         0xE7, 0xB5, 0xD8, 0xE0, 0x5F, 0x66, 0x78, 0xFA, 0xE1, 0x41,
+     },
+     491},
     {{
          0xD4, 0xAF, 0x6C, 0x0A, 0x48, 0x23, 0x10, 0xBD, 0x7C, 0x54, 0xBB,
          0x7A, 0xB1, 0x21, 0x91, 0x6F, 0x86, 0xC0, 0xC0, 0x7C, 0xD5, 0x2F,

tools/metrics/histograms/enums.xml

@@ -31524,6 +31524,10 @@ Called by update_net_trust_anchors.py.-->
       label="282fb5cfbaf01518d9704de7884d7a25ff01cf882e994290d5995d5eb6c44988"/>
   <int value="490"
       label="fd371bea9755ff60c8828c849b8e5215de532d61b009855fa0ad630d90eef82e"/>
+  <int value="491"
+      label="d49c6f289cd056519492480f192f00a6fc7c1862dab2e7b5d8e05f6678fae141"/>
+  <int value="492"
+      label="cbad7b1d384849df0946b7ee8e7f5f7ce3aed876fda7bc9d30d8b16f29ff2c53"/>
 </enum>
 
 <enum name="Network3GGobiError">