x/pkgsite: mixed content warning on overview pages with links to third-party, insecure content

[andybons]

https://pkg.go.dev/github.com/sirupsen/logrus@v1.6.0?tab=overview triggers a mixed-content warning “Not Secure” in Chrome’s location bar.

GitHub (https://github.com/sirupsen/logrus/blob/v1.6.0/README.md) serves these assets themselves via https with a data-canonical-url attribute containing the original source.

NPM serves mixed content (https://www.npmjs.com/package/moment).

[mvdan]

I encounter the same on https://pkg.go.dev/github.com/dgraph-io/badger/v2@v2.2007.2.

It actually made me think there was a legitimate security bug in pkgsite itself, and the warning is kind of scary on Firefox.