Send isSecure false instead of null when an insecure site has passive mixed content

[diracdeltas]

Fix #9652

If a site is already insecure and receives passive mixed content, the security state should remain insecure instead of changing to unknown.

Test Plan:

1. go to https://video.foxbusiness.com/v/5068842750001/?#sp=show-clips
2. click 'allow ads' so that the video will play
3. the URL bar icon should not disappear when the video starts

Submitter Checklist:

• Submitted a ticket for my issue if one did not already exist.
• Used Github auto-closing keywords in the commit message.
• Added/updated tests for this change (for new code or code which already has tests).
• Ran git rebase -i to squash commits (if needed).
• Tagged reviewers and labelled the pull request as needed.

Test Plan:

Reviewer Checklist:

Tests

• Adequate test coverage exists to prevent regressions
• Tests should be independent and work correctly when run individually or as a suite ref
• New files have MPL2 license header

[darkdh]

++