Cherry-pick fixes for HTTPS-Only mode

A cypherpunk sent some known HTTPS-Only issues that we could cherry-pick (they have not been uplifted upstream, though): #41050 (comment 2822085)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1722489 (66533018): Evaluate HSTS before https-only
• https://bugzilla.mozilla.org/show_bug.cgi?id=1724080 (6aafd54c): Disable some speculative HTTP connections