Audit: Security v2 audits meta

Spoke with @lgarron, the brains behind devtools security panel to better understand a comprehensive view of security testing.
### HTTPS redirect.

Because of HSTS, we cannot fully trust this browser's redirect behavior to be representative of what will happen in the wild. (A site can be in the local HSTS list, but not actually have a redirect in place. This would result in a false positive. It's an edge case, but hey that's what security is all about. The truth on this one has to come from cURL, etc until the browser has a way to disable HSTS.
**Verdict:** The PR in #270 is good for now. We can harden this later.
### HSTS testing.

The [hsts preload submission site](https://hstspreload.appspot.com/) has a number of audits written. This includes a test for HTTPS Redirect in fact! And there's an API endpoint, though it's still in development, so we will need to work with Lucas if we decide we want to go forward with that. For example, see the results of https://hstspreload-mvm.appspot.com/checkdomain/web.telegram.org , https://hstspreload-mvm.appspot.com/checkdomain/google.com

**Verdict:** Some great infrastructure that's well aligned we can reuse.
### TLS, Connection & Certificate chain

[SSLLabs test](https://www.ssllabs.com/ssltest/) does have an API, which we could consume and surface... Example response: https://api.ssllabs.com/api/v2/analyze?host=twitter.com&all=on
**Verdict:** It's canonical and the best thing to highlight once we need more detail than what Security domain provides.
### CSP, X-Content-Type, SRI, etc etc

There's some fantastic work in [mozilla/http-observatory-cli](https://github.com/mozilla/http-observatory-cli) It's also [available by API](https://github.com/mozilla/http-observatory-cli/blob/master/httpobscli/cli.py#L21). Lucas has worked with April and expects we could collaborate smoothly here, too.
**Verdict:** Looks promising, and a good basis for some v2 audits.

_edit_: more stuff in [CSP Evaluator](https://csp-evaluator.withgoogle.com/) which looks sorta open source.

---------

_July 2017 update:_

There's also https://securityheaders.io/ and https://www.hardenize.com/. Both look great.

_Oct 2019 update:_

[Proposal here for XSDB auditing](https://bugs.chromium.org/p/chromium/issues/detail?id=806070)