robots.txt was inaccessible to Lighthouse since connect-src for Content
Security Policy didn't include `self`. It now does! Also reorganized the
file a bit & removed an invalid sitemap declaration from robots.txt
itself. Only Google and Bing supported it, and they already know the
site.