Update https-everywhere-checker to disable single target hosts rather than entire rules #1998

One common case in https-everywhere-checker is a single hostname that has been disabled or no longer supports HTTPS. Right now the checker will disable the whole ruleset. For large domains with many subdomains, this is more disruptive than is warranted for a single subdomain. It's also correspondingly more likely for such domains.

The checker should be able to automatically comment out single target hosts in rulesets if a fetch test for that hostname fails, and the ruleset is simple (no exclusions, only an http->https rewrite).