Allow importing settings from HTTP URLs

[sleroq]

Right now browser automatically upgrades http requests to https because of Default content security policy in Manifest V3

Internal infrastructure at my company uses HTTP for configuration, making HTTPS-only imports difficult.

Thanks for the great extension!

[erosman]

Thank you.
I am verifying a few things from Mozilla Engineers.
Is that for both Firefox & Chrome?

[sleroq]

Chrome works fine without this change for some reason.

I'm guessing they have different defaults for content_security_policy.

[erosman]

See also: Inconsistency: Default content security policy

[erosman]

Add-on Policies

• Add-ons must not relax web page security headers, such as the Content Security Policy.

For the time being, you can use a proxy to get those HTTP resources (not ideal though).
If they are on localhost, read Help: Global Exclude