Plumb trust anchor IDs to network service via SSLConfigClient

The network service needs to know what TLS Trust Anchor IDs Chrome
trusts, so that (in a follow-up CL) it can intersect these with the
server-advertised TAIs and tell the server during the TLS handshake
which of its available certificates the client is likely to trust.

The list of trusted TAIs comes from the Chrome Root Store metadata. This
CL plumbs the TAIs to the network service by way of SSLConfigClient.
TAIs are set initially on NetworkContextParams::initial_ssl_config from
the compiled-in root store data. In addition, PKI metadata component
updates call into SystemNetworkContextManager to notify SSLConfigClients
that a new list of trusted TAIs is available.

Bug: 415720499
Change-Id: I76f939f4f6e7c0b43f9e14bb91e94384351d8a80
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6604297
Commit-Queue: Emily Stark <estark@chromium.org>
Reviewed-by: Matt Mueller <mattm@chromium.org>
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Reviewed-by: Joshua Pawlicki <waffles@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1468732}