After the SecurityStateModel refactor for headless Chrome (https://codereview.chromium.org/2448943002/), we should make sure that the tests for the security_state component and SecurityStateTabHelper (formerly ChromeSSMClient) live in reasonable places. In particular tests for the content part of the security_state component should live in the content part of the component, not in chrome/browser/ssl.