fix(scan): grade hsts on the final response scheme after redirects

[TBX3D]

hsts grading was gated on the scheme of the originally requested url,
but the client follows redirects, so an http target that redirects to
https skipped the hsts check entirely and dropped a high-severity
finding. decide the scheme from the final response request url instead,
falling back to the requested url only when no response request is set.

[github-actions]

pr summary

2 files changed (+67 -1)

category	files
go source	2
tests	1

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@7ea1cd2). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #310   +/-   ##
=======================================
  Coverage        ?   54.78%           
=======================================
  Files           ?       81           
  Lines           ?     6878           
  Branches        ?        0           
=======================================
  Hits            ?     3768           
  Misses          ?     2841           
  Partials        ?      269           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vmfunc]

right, resp.Request.URL is the final hop and the client follows redirects by default, so an http target that 301s to https was silently dropping the hsts finding before this. grading against the final scheme lines up with reading resp.Header off that same final response too, so it's consistent. fallback and the four test cases are good. in.