core(has-hsts): account for preloaded public suffixes

[KirtiRamchandani]

Fixes #16680

Summary

• Treat URLs under Chromium HSTS preload entries with policy: "public-suffix" as already covered for the audit's preload recommendation.
• Suppress only the missing-preload warning for those suffixes, while preserving the existing max-age, includeSubDomains, and syntax checks.
• Add regression coverage for .dev plus a multi-label preloaded public suffix.

Root Cause

The audit previously evaluated only the response header directives. Domains under preloaded public suffixes such as .dev are already covered by Chrome's HSTS preload policy, so requiring a site-level preload directive creates a false warning for pages like https://expo.dev.

Tests

• corepack yarn install --frozen-lockfile --ignore-scripts --network-timeout 100000
• Reproduced the original https://expo.dev audit warning with a local audit-level fixture before the fix
• corepack yarn mocha core/test/audits/has-hsts-test.js
• corepack yarn eslint core/audits/has-hsts.js core/test/audits/has-hsts-test.js
• corepack yarn type-check
• corepack yarn i18n:checks
• git diff --check

Also attempted corepack yarn diff:sample-json; it timed out locally after 3 minutes without output.