Points removed for HTTPS on HSTS TLDs

[DeJayDev]

Provide the steps to reproduce

1. Run LH on http://dejay.dev

What is the current behavior?

• Lighthouse removes points for "Does not use HTTPS" even though the domain physically cannot NOT be https.

  Every .dev domain is on the HSTS preload list, which makes HTTPS required on all connections. That means built-in security for you and your customers.

What is the expected behavior?

• Points are not removed for this reason.

Environment Information

• Affected Channels: https://web.dev/measure/
• Lighthouse version: 6.3.0

Related issues
#11455

Notes
I don't use Chrome, I don't have a chrome/node.js version so I've removed those from the above Environment Information.

[patrickhulce]

Thanks for filing @DeJayDev! This is wild, PSI appears to audit an HTTP version of .dev domains somehow... We'll have to look into it.

The usual "your site redirected" note appears outside of PSI, which is a separate issue that should also be addressed at some point for these HTTPS-only domains but currently WAI.