Ignore Strict-Transport-Security on https://localhost responses

Localhost is inherently a secure context, and Strict-Transport-Security
response headers can cause problems because they are not isolated by
port causing compatibility problems for web developers testing locally
as well as end-users who use software packages that commonly spin up
localhost webservers for ephemeral reasons (e.g. communication of an
auth token from a web login to a local software package). If one local
listener sets Strict-Transport-Security on a localhost response, it
will be applied to all subsequent localhost requests regardless of port.

We resolve this problem by matching Firefox and ignoring HSTS headers
on responses from localhost URLs.

Bug: 41251622
Change-Id: Ibebddb97aabe3f2a9c2a6008d314116cafe28a1e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5923046
Reviewed-by: Adam Rice <ricea@chromium.org>
Commit-Queue: Eric Lawrence <ericlaw@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1375901}