fix: do not flag blob urls as insecure

[patrickhulce]

fixes #2323

[ebidel]

Maybz a test

[brendankenny]

Looks good. Just to confirm, chrome treats than the same way?

[patrickhulce]

Looks good. Just to confirm, chrome treats than the same way?

yup

var debug = {hello: "world"};
var blob = new Blob([JSON.stringify(debug, null, 2)], {type : 'application/json'});
var url = URL.createObjectURL(blob);
fetch(url).then(resp => resp.json()).then(console.log);
> Object {hello: "world"}
fetch('http://same-domain').then(resp => resp.json()).then(console.log);
> Mixed Content: The page at 'https://developer.mozilla.org/en-US/docs/Web/API/Blob' was loaded over HTTPS, but requested an insecure resource 'http://developer.mozilla.org/en-US/docs/Web/API/Blob'. This request has been blocked; the content must be served over HTTPS.