In `MeasurementPolicy::from_file_or_url` only allow HTTP on the loopback addresses

`MeasurementPolicy::from_file_or_url` accepts HTTP (plain text) URLs for the measurement policy load.

This poses a danger of policy spoofing if it's retrieved from external source.

We should only allow HTTP on loopback connections (i.e. same host).