tls_cert_verifier_ is now const and only network thread accessed

After recent refactorings, PeerConnection.tls_cert_verifier_ is
now both const and only accessed on the network thread, so it is
doubly thread-safe. Marking as such.

Bug: webrtc:9987
Change-Id: I2f924ecf2afe364d1e4b7f740435443bc53e4d0c
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/191486
Reviewed-by: Karl Wiberg <kwiberg@webrtc.org>
Commit-Queue: Harald Alvestrand <hta@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#32545}
diff --git a/pc/peer_connection.cc b/pc/peer_connection.cc
index 8faac3b..4b2a9d3 100644
--- a/pc/peer_connection.cc
+++ b/pc/peer_connection.cc
@@ -1844,6 +1844,7 @@
     webrtc::TurnCustomizer* turn_customizer,
     absl::optional<int> stun_candidate_keepalive_interval,
     bool have_local_description) {
+  RTC_DCHECK_RUN_ON(network_thread());
   port_allocator_->SetCandidateFilter(
       ConvertIceTransportTypeToCandidateFilter(type));
   // According to JSEP, after setLocalDescription, changing the candidate pool
diff --git a/pc/peer_connection.h b/pc/peer_connection.h
index d928b3e..82c65b5 100644
--- a/pc/peer_connection.h
+++ b/pc/peer_connection.h
@@ -632,9 +632,8 @@
                                // pointer is given to
                                // |jsep_transport_controller_| and used on the
                                // network thread.
-  const std::unique_ptr<rtc::SSLCertificateVerifier>
-      tls_cert_verifier_;  // TODO(bugs.webrtc.org/9987): Accessed on both
-                           // signaling and network thread.
+  const std::unique_ptr<rtc::SSLCertificateVerifier> tls_cert_verifier_
+      RTC_GUARDED_BY(network_thread());
 
   // The unique_ptr belongs to the worker thread, but the Call object manages
   // its own thread safety.