[Security] Add support for Certificate Transparency in Brave

[fmarier]

We currently don't enforce certificate transparency in Brave, unlike Chrome and Safari.

This is what the interstitial looks like like Chrome:

It involves the PKI metadata component, which we enable in Brave, the ERR_CERTIFICATE_TRANSPARENCY_REQUIRED_ERROR error code as well as these feature flags:

• https://source.chromium.org/chromium/chromium/src/+/main:net/http/transport_security_state.h;l=399-402;drc=24c62dad2a729f8c0601c46e74959630484b6943
• https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/browser_features.cc;l=143-147;drc=b03884a3a1ffb3ad8ec269590843203db9e7a386
• https://source.chromium.org/chromium/chromium/src/+/main:components/certificate_transparency/ct_features.h;l=14-30;drc=bf4a6f76e26465d23d2d6a0af7e263a3e4f4ada7

Turning on these flags in brave://flags doesn't help:

[fmarier]

From https://source.chromium.org/chromium/chromium/src/+/main:net/docs/certificate-transparency.md?q=CERTIFICATE_TRANSPARENCY_REQUIRED&ss=chromium%2Fchromium%2Fsrc&start=31:

However, as Google Chrome looks to roll out a more rigorous enforcement of Certificate Transparency, by enforcing that newly-issued certificates are disclosed as a condition of being trusted, the risks to the CA and CT ecosystem significantly increase if embedders implement CT without the ability for reliable, rapid updates, keeping track with ongoing development in the main tree and reliably delivering security updates on the same cadence as Chromium branches and Google Chrome releases.

For this reason, the CT implementation is undergoing a refactoring to reduce those risks through code and implementation. As a result, Chromium embedders will NOT have CT enforcement enabled by default, and are NOT encouraged to manually enable it at this time.

[fmarier]

The reason CT enforcement is disabled in Brave is that the RequireCTDelegate doesn't change the default CT policy. This delegate is set based on params_->enforce_chrome_ct_policy which is set based on IsCertificateTransparencyEnabled().

Removing the GOOGLE_CHROME_BRANDING and OFFICIAL_BUILD checks:

diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/sys>
index 0269a74140c80..7b72a383bc279 100644
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc
@@ -896,7 +896,8 @@ bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() {
   return true;
 #endif
 #else
-  return false;
+  //return false;
+  return true;
 #endif
 }

I was able to make the test page work.

[fmarier]

Before we enable this, we need to ensure that SCT auditing is turned off and not sending any data.

See https://source.chromium.org/chromium/chromium/src/+/main:chrome/common/chrome_features.cc;l=864-872;drc=a8473792f0f00c3574886d861118219f54fd3620 for the feature flag.

[stephendonner]

Verification PASSED using

Brave	1.53.67 Chromium: 114.0.5735.53 (Official Build) beta (x86_64)
Revision	c499d7ea22c8b2dba278465a5df7b86a8efa4e64-refs/branch-heads/5735@{#970}
OS	macOS Version 11.7.7 (Build 20G1345)

Steps:

1. installed 1.53.67
2. launched Brave
3. opened https://no-sct.badssl.com in Brave
4. confirmed the TLS error page with code NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
5. opened https://sct-exempted.bravesoftware.com in Chrome
6. confirmed the TLS error page NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
7. opened https://sct-exempted.bravesoftware.com in Brave
8. confirmed that the page loaded fine
9. opened the same page in Chrome
10. confirmed I got the above ERR_CERTIFICATE... page

no-sct.badssl.com Brave	no-sct.badssl.com Chrome	sct-exempted.bravesoftware.com/ Brave	sct-exempted.bravesoftware.com Chrome

[MadhaviSeelam]

Verification PASSED using

Brave | 1.53.76 Chromium: 114.0.5735.90 (Official Build) beta (64-bit)
-- | --
Revision | 386bc09e8f4f2e025eddae123f36f6263096ae49-refs/branch-heads/5735@{#1052}
OS | Windows 11 Version 22H2 (Build 22621.1702)

Steps:

1. installed 1.53.76
2. launched Brave
3. opened https://no-sct.badssl.com in Brave
4. confirmed the TLS error page with code NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
5. opened https://sct-exempted.bravesoftware.com in Chrome
6. confirmed the TLS error page NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
7. opened https://sct-exempted.bravesoftware.com in Brave
8. confirmed that the page loaded fine

Brave (step 4)	Chrome (step 6)	Brave(step 8)

[stephendonner]

Verification PASSED using

Brave 1.53.87 Chromium: 114.0.5735.110 (Official Build) beta (64-bit) 
Revision 1c828682b85bbc70230a48f5e345489ec447373e-refs/branch-heads/5735_90@{#13}
OS Linux

Steps:

1. installed 1.53.87
2. launched Brave
3. opened https://no-sct.badssl.com in Brave
4. confirmed the TLS error page with code NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
5. opened https://sct-exempted.bravesoftware.com in Chrome
6. confirmed the TLS error page NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
7. opened https://sct-exempted.bravesoftware.com in Brave
8. confirmed that the page loaded fine
9. opened the same page in Chrome
10. confirmed I got the above ERR_CERTIFICATE... page

no-sct.badssl.com Brave	no-sct.badssl.com Chrome	sct-exempted.bravesoftware.com/ Brave	sct-exempted.bravesoftware.com Chrome