kiosk: Tighten cert manager UI

- Make prompt_for_network_when_offline default to false;
- Hide "Servers" and "Authorities" tab in kiosk cert manager;

BUG=719907
TEST=CertificateManagerStandaloneWebUITest.testCertsDisplaying
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Review-Url: https://codereview.chromium.org/2920253003
Cr-Original-Commit-Position: refs/heads/master@{#479108}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: 208cf98ca5b1b2bdfdb620b68d20af6109a23c79

chrome_device_policy.proto

diff --git a/chrome_device_policy.proto b/chrome_device_policy.proto
index d8e48b5..ea325e2 100644
--- a/chrome_device_policy.proto
+++ b/chrome_device_policy.proto
@@ -376,16 +376,16 @@
   optional bool enable_auto_login_bailout = 4 [default = true];
 
   // Whether network configuration should be offered or not when the device
-  // does not have access to the Internet. If the policy is omitted or set to
-  // true, the network configuration will be offered. Otherwise, only an error
-  // message is displayed.
-  // Note: If both this policy and enable_auto_login_bailout policy above is
-  // set to false, there are chances that the device might become totally
-  // unusable when there is no Internet access and has to go through the
-  // recovery process.
+  // does not have access to the Internet. If the policy is set to true, the
+  // network configuration will be offered. Otherwise (policy is omitted or set
+  // to false), only an error message is displayed.
+  // Note: If enable_auto_login_bailout policy above is set to false and this
+  // policy is omitted or  set to false, there are chances that the device might
+  // become totally unusable when there is no Internet access and has to go
+  // through the recovery process.
   // If the device is offline at startup then the network configuration screen
   // is always shown, before auto-login kicks in.
-  optional bool prompt_for_network_when_offline = 5 [default = true];
+  optional bool prompt_for_network_when_offline = 5 [default = false];
 }
 
 message AllowRedeemChromeOsRegistrationOffersProto {