How should we handle HSTS headers and HTTP redirects in the redirect chain?

# 🐛 Bug Report

The current pshtt logic that examines the HSTS headers gives credit if any HSTS header encountered in the redirect chain involves the initial endpoint/hostname. If the redirect chain goes on to send the user to an HTTP URL on an entirely different domain for which the browser has never seen an HSTS header, then it seems to me that the user is not being protected by the HSTS header.

How should we handle this case?

Please also see the discussion [here](https://github.com/cisagov/pshtt/pull/193#pullrequestreview-240321548) in #193.

Start with the current pshtt logic that evaluates HSTS headers across a redirect chain, then read the discussion in pull request #193 linked from the issue. Define how an HTTP redirect to a different domain should affect the HSTS result; done means the project has an agreed behavior and corresponding validation for that case.

Written by the indexing model from the issue text.