Restrict SafetyNet Safe Browsing checks to HTTP/HTTPS URLs

[fmarier]

Google will be updating their documentation, but they have confirmed that they only support HTTP/HTTPS URLs in that API. Therefore there's no need to check things like wss://example.com.

[fmarier]

We should also stop checking subresources: chromium/chromium@619b0dd

Test page at https://fmarier.org/unprotected/sb-subresources.html

[fmarier]

I'll mark it as QA/Yes and release-notes/include because the Safe Browsing spec has changed and now says that subresources need to be excluded. So this is no longer just a performance improvement for us, it's also a matter of complying with the spec.

[samartnik]

Regarding subresources, checked with @fmarier https://fmarier.org/unprotected/sb-subresources.html and it appears SafetyNetApiHandler interface, that we implement, handles this case. Here is the list of url we receive for checking via that interface:

https://fmarier.org/unprotected/sb-subresources.html
https://fmarier.org/unprotected/sb-subresources-image.html
https://fmarier.org/unprotected/sb-subresources-css.html
https://fmarier.org/unprotected/sb-subresources-fetch.html
https://fmarier.org/unprotected/sb-subresources-js.html
https://fmarier.org/unprotected/sb-subresources-iframe1.html
https://fmarier.org/unprotected/sb-subresources-iframe2.html
https://fmarier.org/unprotected/sb-subresources-iframe3.html
https://fmarier.org/unprotected/sb-subresources-iframe4.html