mitigate HSTS fingerprinting

[diracdeltas]

Test plan

See #13437

Original issue description

context: it has been reported in various places that Criteo is using HSTS supercookies (where they buy a bunch of domains and set HSTS on a different subset of domains for each user in order to uniquely identify them) for ad tracking. https://www.gothamcityresearch.com/single-post/2017/10/12/Criteo-SA-NASDAQ-CRTO-Why-We-Believe-Criteo%E2%80%99s-Undisclosed-Practices-are-Illegal-and-Harmful-to-Advertisers

possibilities:

1. double-key HSTS
2. disallow 3rd parties from setting HSTS

[diracdeltas]

adding to 0.20.x, per @BrendanEich suggestion

currently the proposal seems to boil down to: don't apply HSTS on 3rd party subresource loads, unless that subresource has been visited as a first party (similar to Safari's 3rd party cookie policy)

[bsclifton]

Moving to 0.21.x for now- let's move it back if this is finished before Jan 8th and doesn't require a Muon change 😄

[alexwykoff]

@diracdeltas is this release blocking?

[diracdeltas]

it would be really good if this were included in 0.21.x since people have been asking for it for a while. cc @jumde

[bsclifton]

Depends on brave/muon#527

@diracdeltas please note that the milestone was adjusted during today's triage meeting; once the work is complete, we can find the right place for it 😄

[diracdeltas]

it now depends on brave/muon#532 which is a simpler change. moving to 0.22.x for now

[bsclifton]

Re-opening after reverting browser-laptop code with #13638

[btlechowski]

Verified Win7 x64 v0.22.108

Steps used to verify:

1. Open Brave. Disable HTTPS Everywhere in preferences.
2. Clear browsing history and cache
3. Go to https://jsfiddle.net/pqwdgr5x/5/
4. Bring Debugger(F12) and open Network tab
5. Tick 'Preserve log' and select 'Other'
6. Press F5 to reload

Expected result:
301 redirect

Steps used to verify:

1. Open Brave. Disable HTTPS Everywhere in preferences.
2. Clear browsing history and cache
3. Go to https://avatars2.githubusercontent.com/u/1903815?s=40&v=4
4. Go to https://jsfiddle.net/pqwdgr5x/5/
5. Bring Debugger(F12) and open Network tab
6. Tick 'Preserve log' and select 'Other'
7. Press F5 to reload

Expected result:
307 redirect

Verified on macOS 10.12.6 x64 using the steps above and the following build:

• 0.22.109 5e4846e
• libchromiumcontent: 65.0.3325.181
• muon: 6.0.3

Verified on Ubuntu 17.10 x64

• 0.22.703 903b8d0
• libchromiumcontent 66.0.3359.139
• muon: 6.0.8