You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements (Extended Version)