Enable security components

[fmarier]

Resolves brave/brave-browser#12999 and brave/brave-browser#13010

Submitter Checklist:

• There is a ticket for my issue.
• Used Github auto-closing keywords in the commit message.
• Wrote a good PR/commit description
• Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
• Checked the PR locally: npm run test -- brave_browser_tests, npm run test -- brave_unit_tests, npm run lint, npm run gn_check, npm run tslint
• Ran git rebase master (if needed).
• Requested a security/privacy review as needed (not needed: no extra network requests other than already-proxied component updater).

Reviewer Checklist:

• New files have MPL-2.0 license header.
• Adequate test coverage exists to prevent regressions
• Major classes, functions and non-trivial code blocks are well-commented
• Changes in component dependencies are properly reflected in gn
• Code follows the style guide
• Test plan is specified in PR before merging

After-merge Checklist:

• The associated issue milestone is set to the smallest version that the
  changes has landed on.
• All relevant documentation has been updated, for instance:
  • https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
  • https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
  • https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
  • https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
  • https://github.com/brave/brave-browser/wiki/Custom-Headers
  • https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
  • https://github.com/brave/brave-browser/wiki/QA-Guide
  • https://github.com/brave/brave-browser/wiki/P3A

Test Plan:

1. Start Brave with a new profile.
2. Go into chrome://components.
3. Check that Safety Tips has a version number greater than 0 (e.g. 2533).
4. Check that Certificate Error Assistant has a version number greater than 0 (e.g. 7).
5. Visit https://badssl.com/test/safety-tips/ and confirm that it triggers a notification:

[simonhong]

@mherrmann if your fix(#7164) is merged, maybe this PR is not needed?

[mherrmann]

Do I understand correctly that the goal of this PR is to get Certificate Error Assistant and Safety Tips installed in Brave? If yes, then @simonhong correctly points out that #7164 has a connection to this PR. Specifically, if #7164 is merged before this one, then it will be enough to remove the two components from disallowed_components. The forceful call to BraveOnDemandUpdate will no longer be necessary. There is one caveat: BraveOnDemandUpdate leads to the component being installed immediately on browser start. Without this, the component will be installed on the first automatic update check, which happens roughly one minute (iirc) into the browser running.

If this delay is acceptable, then I think it would be cleaner to merge #7164 first, then simplify this present PR.

[simonhong]

Yes, it seems this PR want to enable these two components. and avoiding install during the startup would be nice.

[fmarier]

If this delay is acceptable, then I think it would be cleaner to merge #7164 first, then simplify this present PR.

Let's do that. I'll wait for that PR to merge and then rebase this one.

[simonhong]

@fmarier fyi #7164 is merged.
I confirmed that only removing them from disallowed list works well.

[fmarier]

Thanks @simonhong . I have updated the patch with all that's needed now.

[mherrmann]

lgtm

[mkarolin]

++