Should not be allowed to resolve file: URIs from http/http

Resolving a `file` URI from a `http`/`https` base URI is a security concern (and reproducibility concern!)

```python
fetcher.urljoin("http://example.com/bar/soup.cwl", "file:///C:/Users/fred/foo.cwl")
```

I think the above should always throw `ValueError` if the base URI is not in scheme `file:`.

In addition, considering #129 / #110 on Windows resolving `C:/something` should also fail if the base is not a `file:`