Add check for HTTPS reinforcement.

Problem/Motivation

There is currently no Drupal FIT check to verify that HTTPS is consistently enforced (for example, HTTP traffic being redirected to HTTPS and transport security headers being present), which can leave user credentials and other sensitive data exposed over unencrypted connections.

Steps to reproduce

Proposed resolution

Add a new Security FitCheck plugin HttpsEnforcementCheck that:

• Checks whether the site is accessible over plain HTTP without redirection to HTTPS, and whether key HTTPS-related headers like Strict-Transport-Security are present.
• Fails with FitWeight::High (or FitWeight::Critical for sites handling sensitive data) when HTTP access is not redirected or HSTS is missing, and passes with FitWeight::Ok when HTTPS and HSTS are correctly enforced.
• Includes a short help message explaining that all traffic should be served over HTTPS and recommending enabling global HTTPS redirects and HSTS at the application or web server level.

Remaining tasks

User interface changes

API changes

Data model changes