During testing, we've wanted to evaluate the speed of OCSP versus CRLite, but when we start to experiment with user-feel, we need to be able to halt revocation checks before OCSP fires, since we've gotten an authoritative answer from CRLite.

This bug is to add a preference to stop the revocation check if CRLite gave an authoritative answer, and not do OCSP or the OCSP/CRLite telemetry.

We'd want to stop after this block:

https://searchfox.org/mozilla-central/rev/803b368879fa332e8e2c1840bf1ec164f7ed2c32/security/certverifier/NSSCertDBTrustDomain.cpp#785-806

We could do this as another stage in the CRLite enum, or we could make "Enforcing" do it, or we could add a new preference that is just "crlite is authoritative." I think all have pros/cons.

When the CRLite mode is "enforce" and a certificate is found to be covered by
CRLite, this patch makes it so the implementation will not fall back to
processing OCSP (whether stapled, cached, or fetched). This also updates
test_crlite_filters.js to use a more recent, realistic filter and stash.

https://hg.mozilla.org/mozilla-central/rev/09cb61c1b3ee