Domain substitution breaks Google WebAuthn AppID validation

Domain substitution currently rewrites content/browser/webauth/webauth_request_security_checker_impl.cc and .h. Those files contain the upstream Chromium Google AppID compatibility check:

• caller_origin.DomainIs("google.com")
• https://www.gstatic.com/securitykey/origins.json
• https://www.gstatic.com/securitykey/a/google.com/origins.json

After substitution, an explicit appidExclude from accounts.google.com is rejected with SecurityError: This is an invalid domain. The rejection occurs before an attached chrome.webAuthenticationProxy extension receives onCreateRequest, so an authenticator extension cannot handle it.

This is observable in current ungoogled-based builds: a google.com create request with googleLegacyAppidSupport=true reaches the proxy, while the equivalent current Google Account flow with explicit appidExclude using the upstream gstatic URL fails before the proxy.

These strings do not initiate a Google service request. They are local validation constants for a compatibility rule shared by Chromium and Firefox. Excluding the security checker implementation and header from domain substitution preserves that validation without restoring background Google integration.

I have a small change ready that removes those two source files from domain_substitution.list.