More .well-known checks

.well-known (RFC) is becoming an increasingly popular destination for stashing site-wide metadata. Some of that metadata is relevant to site security or may unintentionally leak information, so we should scan it.

Some starting points:

• Presence of/interesting things in an MTA-STS policy (RFC)
  • This might be hampered by the fact that the RFC requires this policy to be hosted on a separate subdomain, e.g. mta-sts.example.com/.well-known/mta-sts.txt.
• Asset links: https://developers.google.com/digital-asset-links/v1/getting-started
• A number of different things on this list: https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers