Validate a container registry URL on create, and check the scheme the error names

ContainerRegistryValidator runs only on update, and what it checks is narrower than the error it raises says. A registry can be created with an address the update path would refuse, and addresses that are not URLs at all are accepted on both paths.

## What the check does

An address that starts with neither http:// nor https:// has http:// prepended before it is parsed, and the result passes as long as the host part is not empty. So ftp://reg.example and the string 'not a url' both pass, while InvalidContainerRegistryURL says 'Invalid URL format'. Only an address whose host comes out empty is refused.

## Expected

- The check runs on create as well as update, so the same address is treated the same way on both paths.
- The check accepts only http and https, which is what its error already claims.

## Note for the reviewer

Tightening the scheme means a row that already holds a non-http address is refused the next time it is updated. That is the point of the change, but it is worth deciding deliberately.

## Acceptance

- Creating a registry with an address the update path refuses is itself refused.
- Scenario rows cover both paths.

JIRA Issue: BA-7858

Start by locating ContainerRegistryValidator and the create and update paths that invoke it. Read the existing scenario tests and add coverage for both paths, including non-HTTP schemes and addresses without hosts. Done means creation and update apply the same HTTP/HTTPS validation and the scenario rows pass.

Written by the indexing model from the issue text.