Looks like the relevant code is in LocationBarLayout.java, getSecurityIconResource: https://cs.chromium.org/chromium/src/chrome/android/java/src/org/chromium/chrome/browser/omnibox/LocationBarLayout.java?type=cs&q=dangerous+file:%5Esrc/chrome/android/java/src/org/chromium/chrome/browser/omnibox/+package:%5Echromium$&l=1296

(Un-assigning for now due to blocking on further PageInfo efforts.)

This will need to be a part of a broader effort to move more PageInfo logic for mobile into components/security_state/core/security_state_ui.h/.cc. But until that point, the overhead of adding a new JNI interface for calling this one function doesn't seem worth it.

Currently, the behavior between security_state::ShouldAlwaysShow and the java getSecurityIconResource match for all cases.