fix(updater): warn when the update download URL is not https (#3694)

* fix(updater): warn when the update download URL is not https

`validate_endpoints` enforces `https` for the endpoints, but not for the `url`
of the manifest, so the artifact can be downloaded in plaintext. Enforcing it
would break existing releases (left for v3); `Update::download` now logs a
warning instead, unless `dangerousInsecureTransportProtocol` is enabled.

plugins/updater/src/updater.rs

* Apply suggestion from @lucasfernog

.changes/updater-warn-insecure-download.md

@@ -0,0 +1,6 @@
+---
+updater: patch
+updater-js: patch
+---
+
+Log a warning when the download URL of an update does not use `https` and `dangerousInsecureTransportProtocol` is not enabled.