[binding-http] Server side security scheme validation skipped when using `http`

As the title mention, the HTTP server does not verify if a `SecurityScheme` defined by an exposed thing is among the supported schemes or not. As it can be seen the validation is done only if the server is started with `secure` mode (i.e. https) whereas it is skipped if it is in HTTP mode (see [here](https://github.com/eclipse/thingweb.node-wot/blob/master/packages/binding-http/src/http-server.ts#L280)).

Now, should we reject any exposed thing with `SecurityScheme` other than `nosec`, or should we still allow to use a security scheme even over HTTP?(maybe just print a warning?)