Add DCHECKs when NetworkContext is passed an empty NetworkIsolationKey.

In particular, add DCHECKs when an empty NIK is passed when sending a
report, or when verifying a signed exchange's cert (which can send a
report of another type). The DCHECK is only enabled when
require_network_isolation_key is set. Actually respecting the received
NIK is disabled by default, but all consumers outside the network
service should now always be passing a non-empty NIK when using these
APIs.

Bug: 993805, 1087091
Change-Id: I5f4eef6f9f7b3b4faaaedca62e110e695ccabf2e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595630
Reviewed-by: Lily Chen <chlily@chromium.org>
Commit-Queue: Matt Menke <mmenke@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837748}