test(chrome): compare the secure fact across both producers

it is the fourth fact the dump and the web runtime derive independently,
and the one that decides whether a typed value is written into the
shared record. three-valued, so the fixture guard requires all three
states rather than both polarities.

pkg/spec/test/dom-facts-probe.ts

@@ -21,6 +21,7 @@ type AxHandle = {
   attrs?: Record<string, string>;
   clickable?: boolean;
   editable?: boolean;
+  secure?: boolean | null;
 };
 type Ax = { find(selector: unknown): AxHandle | undefined };
 
@@ -50,6 +51,10 @@ function domFacts(): unknown[] {
       hintText: handle?.attrs?.hintText ?? "",
       handleClickable: handle?.clickable ?? false,
       handleEditable: handle?.editable ?? false,
+      // Three-valued, so it stays null rather than collapsing onto false: the Go
+      // side compares it against a dump that leaves the fact out entirely for an
+      // element no producer states it for.
+      secure: handle?.secure ?? null,
       width: target.width ?? 0,
       height: target.height ?? 0,
     };