Fix broken find token image in HTTP

[JamesNK]

Fixes #3603

If the website is http then allow http or https images.
If the website is https then only allow https images.

Working:

Microsoft Reviewers: Open in CodeFlow

[JamesNK]

/backport to release/8.0

[github-actions]

Started backporting to release/8.0: https://github.com/dotnet/aspire/actions/runs/8656686212

[tlmii]

Given that we don't have any external images, would just doing 'self' (or 'self' data:) be better?

[JamesNK]

'self' would have been simpler.

IMO the PR as it is works and could allow external images if needed by a feature at some point. I think we go with this for now. Change more if needed.

[kvenkatrajan]

Approved and thanks for the tests. Just wondering if any XSS concerns with any external site when we specify https

[danmoseley]

We missed the snap anyway, if @tlmii you believe you need to modify this there is time.

[JamesNK]

Approved and thanks for the tests. Just wondering if any XSS concerns with any external site when we specify https

No. An image can't be used to run scripts.