Backfill HAR tests for the privacy, bestpractice and info rules

[soulgalore]

Eleven of fourteen HAR privacy rules were shipping without a safety net,
plus the HAR-level avoidRenderBlocking and the third-party rules in
bestpractice / info. The header-based rules (cross-origin-*-policy,
NEL, Reporting-Endpoints, Permissions-Policy, X-Content-Type-Options)
each get a negative case against an existing fixture and a positive
case built by cloning the fixture and pushing the target header on the
document response — the same pattern technologyTest already used inline.
The reCAPTCHA and mixed-content rules clone a fixture and inject a
matching asset to exercise the positive path.

bestpractice / info. The header-based rules (cross-origin-*-policy,
NEL, Reporting-Endpoints, Permissions-Policy, X-Content-Type-Options)
each get a negative case against an existing fixture and a positive
case built by cloning the fixture and pushing the target header on the
document response — the same pattern technologyTest already used inline.
The reCAPTCHA and mixed-content rules clone a fixture and inject a
matching asset to exercise the positive path.

The third-party rules (privacy/thirdPartyPrivacy, bestpractice/thirdParty,
info/thirdParty) lean on the existing http://www.nytimes.com.har fixture with
the firstParty option set so pagexray classifies the off-domain assets
correctly — that fixture has real surveillance-categorised tracking and
exercises the score=0 branch end-to-end.

A small firstAdviceForHar(har, options) helper was added to
test/help/har.js so the clone-and-run pattern doesn't need to be copied
around the new tests.

Co-authored-by: Claude noreply@anthropic.com