secureOnlyFetch derives the URL with || instead of a ternary, so the constrained fetch throws for every string and URL argument

`security/jsLoader.ts:812`:

```js
const url = typeof resource === 'string' || resource.url;
if (new URL(url).protocol != 'https') throw new Error('Only https is allowed in fetch');
```

The `||` looks like it was meant to be a ternary. As written:

- `fetch('https://example.com')` — `typeof resource === 'string'` is `true`, so `url` is the boolean `true`, and `new URL(true)` throws `TypeError: Invalid URL` before the protocol check runs.
- `fetch(new URL('https://example.com'))` — the left side is `false`, so `url` is `resource.url`, which is `undefined` on a `URL` instance. `new URL(undefined)` throws too.
- Only a Request-like object carrying a `.url` string reaches the protocol check.

So the https-only `fetch` installed under `lockdown: ses` rejects the two most common call forms with a confusing `Invalid URL`, rather than enforcing the policy it exists to enforce.

Reachable when `applications.lockdown: ses` is combined with `moduleLoader: vm` or `compartment` — those are the modes that build a custom global object, and `getGlobalObject` installs `secureOnlyFetch` at `security/jsLoader.ts:856`.

Suggested fix:

```js
const url = typeof resource === 'string' ? resource : (resource.url ?? String(resource));
```

`String(resource)` covers the `URL` instance case via `URL.prototype.toString`.

Worth a test covering all three input forms — string, `URL`, and `Request`.

Found while documenting module loading in HarperFast/documentation#664 (review comment from @kriszyp). The docs PR omits the constrained `fetch` entirely for now; I'll add that section once this ships.

_{sent with Claude Opus 5}

Start at security/jsLoader.ts:812 and trace secureOnlyFetch through its installation at line 856 when lockdown: ses uses vm or compartment. Add coverage for string, URL, and Request inputs, then verify HTTPS URLs pass while non-HTTPS URLs are rejected without Invalid URL errors.

Written by the indexing model from the issue text.