Add missing specifications, update links to HTTPS

[Malvoz]

I'm so sorry for a lenghty PR description... this PR changes:

• [x] Point all outgoing links to https://.
• [x] Change the CSP3 spec link from the level 2 to the level 3 URL.
• [x] List specs alphabetically within their categories (because slight OCD?).
• [x] Update specification's recommendation statuses (e.g. from FPWD to WD). As specified in the headline of the corresponding spec version.
• [x] (!) Added a "Non-Recommendation-Track" category for obsolete or no longer actively maintained specs that fall under webappsec, this included moving some already listed specs to that category as they have obsolete-notices in them. If this is unwanted, remove that category and all the specs with it. If you want to keep this category, is the naming "Non-Recommendation-Track" (inspired by https://www.w3.org/2011/webappsec/) viable in this context?

The following specifications that have been added I found in https://www.w3.org/2011/webappsec/ and https://github.com/w3c?q=webappsec:

• CORS for Developers (added as Non-Recommendation-Track)
• CSP: Cookie Controls (added as Non-Recommendation-Track)
• CSP: Embedded Enforcement
• Feature-Policy
• Fetch Metadata Request Headers
• Suborigins
• Uniform Messaging Policy Level 1 (added as Non-Recommendation-Track)
• User Interface Security and the Visibility API