track adoption of onion services among news organizations via the Onion-Location header

[redshiftzero]

Towards #128, please let me know what you think of adding onion service tracking.

screenshots

per site page

leaderboards

Grades are adjusted such that you cannot get an A+ without having an onion service (down to discuss this in more detail)

TODO

• [x] edit text (done via wagtail) to broaden the scope of this site to include onion services in addition to HTTPS - will do once on staging
• [x] add some tests (added in 4b4d697)
• [ ] discuss grading. This PR makes it such that if you have all the suggested HSTS options, you can only get an A (so currently A+ will go down to A). To get an A+, you need to have the onion service.

[harrislapiroff]

Ready for an initial look over

[redshiftzero]

@thisisparker and I were chatting just now and:

1. the changes in this PR shouldn't interfere with the current STN bot behavior, and
2. once we merge this we'll update the STN twitter bot to tweet out happy messages when news organizations add Onion-Location

[maeve-fpf]

This is very cool! Looks like a rebase will fix the npm_audit check.

[redshiftzero]

thanks @chigby and @maeve-fpf - rebased and CI is indeed passing now 😇