Protect self-update redirects from HTTP downgrade

[ryanfowler]

Summary

• Add a central self-update URL validator that requires HTTPS for release metadata, artifacts, checksums, and redirect targets.
• Allow HTTP only for explicit internal update overrides used by local fixtures.
• Add unit coverage for HTTPS-to-HTTP redirect rejection, initial HTTP rejection, and the internal HTTP fixture path.

Testing

• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --all-features update::tests::update
• cargo test --all-features --test update -- --test-threads=1
• cargo test --all-features -- --test-threads=1