[NSS] sync with https://github.com/roytam1/NSS/tree/NSS_3_48_UXP_BRANCH, notably:

- Bug 1665715 - (1/2) revert e8f2720c8254 (bug 1593141) because it's no longer necessary r=jcj (a9bca998)
- Bug 1665715 - (2/2) pass encoded signed certificate timestamp extension (if present) in CheckRevocation r=jcj (429f9ef9)

security/nss/lib/mozpkix/include/pkix/pkixtypes.h

@@ -277,10 +277,10 @@ class TrustDomain {
 
   virtual Result CheckRevocation(EndEntityOrCA endEntityOrCA,
                                  const CertID& certID, Time time,
-                                 Time validityBeginning,
                                  Duration validityDuration,
                                  /*optional*/ const Input* stapledOCSPresponse,
-                                 /*optional*/ const Input* aiaExtension) = 0;
+                                 /*optional*/ const Input* aiaExtension,
+                                 /*optional*/ const Input* sctExtension) = 0;
 
   // Check that the given digest algorithm is acceptable for use in signatures.
   //

security/nss/lib/mozpkix/lib/pkixbuild.cpp

@@ -251,9 +251,9 @@ PathBuildingStep::Check(Input potentialIssuerDER,
     }
     Duration validityDuration(notAfter, notBefore);
     rv = trustDomain.CheckRevocation(subject.endEntityOrCA, certID, time,
-                                     notBefore, validityDuration,
-                                     stapledOCSPResponse,
-                                     subject.GetAuthorityInfoAccess());
+                                     validityDuration, stapledOCSPResponse,
+                                     subject.GetAuthorityInfoAccess(),
+                                     subject.GetSignedCertificateTimestamps());
     if (rv != Success) {
       // Since this is actually a problem with the current subject certificate
       // (rather than the issuer), it doesn't make sense to keep going; all