Since HTTPS-First is already enabled by default in Private Browsing, it would only make sense to let the user have some more control over it in the settings. Currently, this is only possible via about:config.

There also still is the open terminology question about how "HTTPS-First" should be called for the user. Having both "HTTPS-Only" and "HTTPS-First", which do two very similar things could be confusing. So we could consider calling both "HTTPS-Only", and only have a checkbox which allows you to enable or disable "silent fallbacks to HTTP", which would correspond to HTTPS-First. I have attached an experimental implementation of how this could look like, but keep in mind that this is just an early exploration of how these settings could look like. This implementation would also have the downside that the user could not enable HTTPS-First everywhere and HTTPS-Only in PBM.

Depends on D183745