[secure-contexts] `*.localhost` + DNS

In https://bugs.chromium.org/p/chromium/issues/detail?id=607878#c9, Ryan
and Emily have (again) reminded me that the resolution rules for
`*.localhost` in https://tools.ietf.org/html/rfc6761#section-6.3 are all
MAY or SHOULD, and folks are SHOULDing their way out to the network in
various configurations.

Given this, it's not clear to me that we can ("should"?) treat
`*.localhost` as a secure context. I think it might be a good idea to drop
step 3 of https://www.w3.org/TR/secure-contexts/#is-origin-trustworthy
accordingly.

WDYT?

-mike