Update nss to r223139.

DEPS

 # When adding a new dependency, please update the top-level .gitignore file
 # to list the dependency's destination directory.
 
 vars = {
   # Use this googlecode_url variable only if there is an internal mirror for it.
   # If you do not know, use the full path while defining your new deps entry.
   "googlecode_url": "http://%s.googlecode.com/svn",
   "sourceforge_url": "http://svn.code.sf.net/p/%(repo)s/code",
   "webkit_trunk": "http://src.chromium.org/blink/trunk",
   "nacl_trunk": "http://src.chromium.org/native_client/trunk",
@@ skipping 22 matching lines @@
   "skia_hash": "d99d102dd27d7acca1bbc16884a1a5719fef2568",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and V8 without interference from each other.
   "v8_revision": "16700",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling WebRTC
   # and V8 without interference from each other.
   "webrtc_revision": "4699",
   "jsoncpp_revision": "248",
-  "nss_revision": "220375",
+  "nss_revision": "223139",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarm_client
   # and whatever else without interference from each other.
   "swarm_revision": "221184",
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openssl
   # and whatever else without interference from each other.
   "openssl_revision": "207965",
 }
 
@@ skipping 563 matching lines @@
     "pattern": ".",
     "action": ["python", "src/build/gyp_chromium"],
   },
   {
     # Check for landmines (reasons to clobber the build).
     "name": "landmines",
     "pattern": ".",
     "action": ["python", "src/build/landmines.py"],
   },
 ]