GitLab

After [1], we're stripping `Sec-Fetch-*` headers from non-secure
transport. This is lovely! Except insofar as it also strips the headers
from secure redirect targets. Which is a problem, as it gives attackers
the option of laundering their requests through HTTP to strip the
headers.

This patch removes the secure transport restriction while we figure out
a cleaner way of removing the headers on a per-hop basis.

[1]: https://chromium-review.googlesource.com/c/chromium/src/+/1647354

Bug: 995745, 971938, 964053
Change-Id: Icec4e685902b7be2983bb81b7289ac9b45467782
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1762079
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: Eric Lawrence [MSFT] <ericlaw@microsoft.com>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#689428}