fix(updater): warn when the update download URL is not https (#3694)

* fix(updater): warn when the update download URL is not https

`validate_endpoints` enforces `https` for the endpoints, but not for the `url`
of the manifest, so the artifact can be downloaded in plaintext. Enforcing it
would break existing releases (left for v3); `Update::download` now logs a
warning instead, unless `dangerousInsecureTransportProtocol` is enabled.

plugins/updater/src/updater.rs

* Apply suggestion from @lucasfernog

plugins/updater/src/updater.rs

@@ -821,6 +821,18 @@ impl Update {
         mut on_chunk: C,
         on_download_finish: D,
     ) -> Result<Vec<u8>> {
+        // not enforced (unlike for the endpoints) as that would break existing releases, but the
+        // artifact then travels in plaintext: only its signature protects it
+        // TODO(v3): enforce it
+        if self.download_url.scheme() != "https"
+            && !self.context.config.dangerous_insecure_transport_protocol
+        {
+            log::warn!(
+                "the update download URL {} does not use the `https` protocol",
+                self.download_url
+            );
+        }
+
         // set our headers
         let mut headers = self.headers.clone();
         if !headers.contains_key(ACCEPT) {