Fetch and validate /.well-known/security.txt against RFC 9116.
We fetch /.well-known/security.txt (then /security.txt) and validate it against RFC 9116.