fixup! Bug 40925: Implemented the Security Level component

Bug 42617: Use DDG's plain HTML variant on Safest.

Between 115 and 128 we lost the engine parameter, so we are not given
the search engine's ID anymore.
So, switch to comparing the hostname instead.

toolkit/components/search/SearchEngine.sys.mjs

@@ -12,6 +12,7 @@ ChromeUtils.defineESModuleGetters(lazy, {
   NimbusFeatures: "resource://nimbus/ExperimentAPI.sys.mjs",
   SearchSettings: "resource://gre/modules/SearchSettings.sys.mjs",
   SearchUtils: "resource://gre/modules/SearchUtils.sys.mjs",
+  SecurityLevelPrefs: "resource://gre/modules/SecurityLevel.sys.mjs",
   OpenSearchEngine: "resource://gre/modules/OpenSearchEngine.sys.mjs",
 });
 
@@ -439,6 +440,26 @@ export class EngineURL {
    */
   getSubmission(searchTerms, queryCharset, purpose) {
     var url = ParamSubstitution(this.template, searchTerms, queryCharset);
+
+    if (
+      lazy.SecurityLevelPrefs?.securityLevel === "safest" &&
+      this.type === lazy.SearchUtils.URL_TYPE.SEARCH
+    ) {
+      let host = this.templateHost;
+      try {
+        host = Services.eTLD.getBaseDomainFromHost(host);
+      } catch (ex) {
+        lazy.logConsole.warn("Failed to get a FPD", ex, host);
+      }
+      if (
+        host === "duckduckgo.com" ||
+        host ===
+          "duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion"
+      ) {
+        url += "html";
+      }
+    }
+
     // Default to searchbar if the purpose is not provided
     var requestPurpose = purpose || "searchbar";