PAS-2: HTTPS paths are only extracted if a TLS handshake has been observed

At the moment, the script uses a list of domains seen in TLS handshakes to search HTTP referrers to identify paths visited on the HTTPS site.

If, however, the capture started after a TLS handshake, information on a given site will be missing despite the fact we have information readily available.

So, it may be better to look at extracting a list of HTTPS sites from the referrer headers that have been captured, and build the known SSL paths based on that information instead.