Lock down services which accept URLs to require https where possible

Let's continue to nudge our ecosystem toward using https. For the most part, when we accept and refactor new services, we steer things that way, by using https endpoints and assuming https for user-provided URLs.

Let's push that forward wherever we can, perhaps by requiring https wherever we're accepting a user-provided URL.

In cases where we think there are sources which can't be migrated, we could add a flag `?allow_insecure`. This would provide an extra hurdle, and would nudge them to use https if possible.

Start by inventorying the services that accept user-provided URLs and identify where each URL is validated or used. Done means HTTPS is required wherever migration is possible, with an explicitly documented allow_insecure path only for sources that cannot migrate.

Written by the indexing model from the issue text.