Deprecate gfe2_restart_flag_quic_set_credential_ex_data.

This CL partially autogenerated by `/google/data/ro/projects/gfe/tools/manage_feature_flags.par deprecate gfe2_restart_flag_quic_set_credential_ex_data`; I manually removed it from each callsite.

Startblock:
  # Flipping production flags for 2026-06-24.
  cl-status gfe2_service_configs contains cl/937427179 everywhere
  after 2026-07-28 12:00 in Google/US-NYC
PiperOrigin-RevId: 955809473

quiche/common/quiche_feature_flags_list.h

diff --git a/quiche/common/quiche_feature_flags_list.h b/quiche/common/quiche_feature_flags_list.h
index 37f799c..8e91640 100755
--- a/quiche/common/quiche_feature_flags_list.h
+++ b/quiche/common/quiche_feature_flags_list.h
@@ -64,7 +64,6 @@
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_use_received_client_addresses_cache, true, true, "If true, use a LRU cache to record client addresses of packets received on server's original address.")
 QUICHE_FLAG(bool, quiche_restart_flag_quic_client_cert_support, false, true, "If true, enables dynamic client certs in QUIC.")
 QUICHE_FLAG(bool, quiche_restart_flag_quic_dispatcher_close_connection_on_invalid_ack, false, false, "An invalid ack is an ack that the peer sent for a packet that was not sent by the dispatcher. If true, the dispatcher will close the connection if it receives an invalid ack.")
-QUICHE_FLAG(bool, quiche_restart_flag_quic_set_credential_ex_data, true, true, "If true, TlsServerConnection::AddCertChain will add CredentialExData as the ex_data of the SSL_CREDENTIAL.")
 QUICHE_FLAG(bool, quiche_restart_flag_quic_support_release_time_for_gso, false, false, "If true, QuicGsoBatchWriter will support release time if it is available and the process has the permission to do so.")
 QUICHE_FLAG(bool, quiche_restart_flag_quic_testonly_default_false, false, false, "A testonly restart flag that will always default to false.")
 QUICHE_FLAG(bool, quiche_restart_flag_quic_testonly_default_true, true, true, "A testonly restart flag that will always default to true.")

quiche/quic/core/crypto/proof_source.cc

diff --git a/quiche/quic/core/crypto/proof_source.cc b/quiche/quic/core/crypto/proof_source.cc
index 3acb2fc..4024337 100644
--- a/quiche/quic/core/crypto/proof_source.cc
+++ b/quiche/quic/core/crypto/proof_source.cc
@@ -56,11 +56,6 @@
 
 void SetCredentialExData(SSL_CREDENTIAL& credential,
                          std::unique_ptr<CredentialExData> exdata) {
-  if (!GetQuicRestartFlag(quic_set_credential_ex_data)) {
-    return;
-  }
-  QUIC_RESTART_FLAG_COUNT_N(quic_set_credential_ex_data, 2, 3);
-
   int index = GetCredentialExDataIndex();
   if (index < 0 || exdata == nullptr) {
     return;
@@ -73,11 +68,6 @@
 }
 
 const CredentialExData* GetCredentialExData(const SSL_CREDENTIAL& credential) {
-  if (!GetQuicRestartFlag(quic_set_credential_ex_data)) {
-    return nullptr;
-  }
-  QUIC_RESTART_FLAG_COUNT_N(quic_set_credential_ex_data, 3, 3);
-
   int index = GetCredentialExDataIndex();
   if (index < 0) {
     return nullptr;

quiche/quic/core/crypto/tls_server_connection.cc

diff --git a/quiche/quic/core/crypto/tls_server_connection.cc b/quiche/quic/core/crypto/tls_server_connection.cc
index a6c6b8d..10b37d6 100644
--- a/quiche/quic/core/crypto/tls_server_connection.cc
+++ b/quiche/quic/core/crypto/tls_server_connection.cc
@@ -79,16 +79,10 @@
                                        absl::string_view trust_anchor_id) {
   bssl::UniquePtr<SSL_CREDENTIAL> credential(SSL_CREDENTIAL_new_x509());
   std::unique_ptr<CredentialExData> exdata;
-  if (GetQuicRestartFlag(quic_set_credential_ex_data)) {
-    QUIC_RESTART_FLAG_COUNT_N(quic_set_credential_ex_data, 1, 3);
-    exdata = std::make_unique<CredentialExData>(std::move(cert_chain));
-    SSL_CREDENTIAL_set1_cert_chain(credential.get(),
-                                   exdata->cert_chain_buffers.value.data(),
-                                   exdata->cert_chain_buffers.value.size());
-  } else {
-    SSL_CREDENTIAL_set1_cert_chain(credential.get(), cert_chain.value.data(),
-                                   cert_chain.value.size());
-  }
+  exdata = std::make_unique<CredentialExData>(std::move(cert_chain));
+  SSL_CREDENTIAL_set1_cert_chain(credential.get(),
+                                 exdata->cert_chain_buffers.value.data(),
+                                 exdata->cert_chain_buffers.value.size());
   if (ssl_config().signing_algorithm_prefs.has_value()) {
     SSL_CREDENTIAL_set1_signing_algorithm_prefs(
         credential.get(), ssl_config().signing_algorithm_prefs->data(),

quiche/quic/core/tls_server_handshaker_test.cc

diff --git a/quiche/quic/core/tls_server_handshaker_test.cc b/quiche/quic/core/tls_server_handshaker_test.cc
index 66616ad..cfd9a00 100644
--- a/quiche/quic/core/tls_server_handshaker_test.cc
+++ b/quiche/quic/core/tls_server_handshaker_test.cc
@@ -1757,11 +1757,7 @@
           // Verify that the extension data is present and non-null.
           const CredentialExData* ex_data = GetCredentialExData(*cred);
 
-          if (GetQuicRestartFlag(quic_set_credential_ex_data)) {
-            ASSERT_NE(ex_data, nullptr);
-          } else {
-            ASSERT_EQ(ex_data, nullptr);
-          }
+          ASSERT_NE(ex_data, nullptr);
           credential_ex_data_verified = true;
         }
       });