HSTS check for preload directive does not look at policies for TLDs and public suffixes

### FAQ

- [x] Yes, my issue is not about [variability](https://github.com/GoogleChrome/lighthouse/blob/main/docs/variability.md) or [throttling](https://github.com/GoogleChrome/lighthouse/blob/main/docs/throttling.md).
- [x] Yes, my issue is not about a specific accessibility audit (file with [axe-core](https://github.com/dequelabs/axe-core) instead).
- [x] Yes, my issue is not answered by [other FAQs](https://github.com/GoogleChrome/lighthouse#faq).

### URL

https://expo.dev

### What happened?

Lighthouse will report, "No `preload` directive found" for a website that includes `strict-transport-security: max-age=31536000; includeSubDomains` in its response headers. This makes sense at first glance because there is no preload directive. However, some TLDs (like .app, .dev) and public suffixes are already in the HSTS preload list and therefore any domain underneath them automatically requires HTTPS -- the website doesn't need its own HSTS policy let alone the preload directive.

Relevant code: https://github.com/GoogleChrome/lighthouse/blob/9b75b033929cd8391ff00e9a73bbe3d4471c0a78/core/audits/has-hsts.js#L13

### What did you expect?

Ideally Lighthouse would check the HSTS preload policy for the TLD or public suffix of the website being tested.

### What have you tried?

_No response_

### How were you running Lighthouse?

Chrome DevTools

### Lighthouse Version

12.6.1

### Chrome Version

Version 139.0.7258.157 (Official Build) (arm64)

### Node Version

_No response_

### OS

macOS 15.6.1

### Relevant log output

```sh

```