Add enterprise policy for renderer CIG.

Whether to enable/disable is checked on the launcher thread in
content. But the actual flag is only accessible on the main thread
from chrome, so the plumbing in render_process_host and
content_browser_client exists to wire these two together.

BUG=750886
TEST=set policy, check renderers start without CIG.

Change-Id: I2ea2286d9e244734abe15b9f8beb62b3f97ffd71
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1758589
Commit-Queue: Will Harris <[email protected]>
Reviewed-by: Lutz Justen <[email protected]>
Reviewed-by: Avi Drissman <[email protected]>
Reviewed-by: Owen Min <[email protected]>
Cr-Commit-Position: refs/heads/master@{#690060}
diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 6972248..27a0a9a 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc
@@ -697,6 +697,7 @@
 #endif
 
 #if defined(OS_WIN)
+  registry->RegisterBooleanPref(prefs::kRendererCodeIntegrityEnabled, true);
   component_updater::RegisterPrefsForSwReporter(registry);
 #if BUILDFLAG(GOOGLE_CHROME_BRANDING)
   IncompatibleApplicationsUpdater::RegisterLocalStatePrefs(registry);