Restrict URI properties to absolute URIs using the https: scheme

[ThisIsMissEm]

This was originally noted in #18 and #19 and changed in #33, however prohibiting just data: and javascript: would not be a sufficient security measure, as there are other URI schemes that are unsafe, such as vbscript: and shortcuts: (apple shortcuts).

Interestingly, I know vbscript: exists, however, it is not registered with IANA: https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml

[ThisIsMissEm]

cc @matthieusieben

[OllieJC]

I'm still not convince logo_uri shouldn't allow data: schemes - requiring https means more requests and more bandwidth. For a simple SVG it could be as little as a ~230 bytes:

"logo_uri": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MDAiIGhlaWdodD0iODAwIiB2aWV3Qm94PSIwIDAgMjAgMjAiPjxwYXRoIGQ9Ik03LjggMTBhMi4yIDIuMiAwIDAgMCA0LjQgMCAyLjIgMi4yIDAgMCAwLTQuNCAweiIvPjwvc3ZnPg=="