Reject non-https download URLs from registry metadata

[andrew]

resolveFromMetadata reads download_url and tarball from the registry's JSON response and hands them straight to the fetcher. A compromised or MITM'd registry could return file:///etc/passwd or http://169.254.169.254/latest/meta-data/ and we'd fetch it.

Now requires scheme https and a non-empty host before returning the ArtifactInfo. Anything else gets ErrUnsafeURL.

This doesn't check IP ranges. That defense belongs in the fetcher's dialer where DNS rebinding can't sneak past it, and would also cover URLs from URLBuilder.Download() and the template paths in resolveWithoutRegistry. Separate change.