fix: reject http:// URLs in PostGuardConfig to prevent plaintext credential leaks

[dobby-coder]

Summary

• Validate PkgUrl and CryptifyUrl are absolute https:// URLs in PostGuard's constructor; throw ArgumentException otherwise.
• Add opt-in AllowInsecureUrls (default false) to permit http://localhost for local development and testing.
• Add an xUnit test project (tests/E4A.PostGuard.Tests) covering the rejection path (http, ftp, ws, relative, empty), the happy path, and the escape hatch.

Why

Closes #14. PostGuardConfig previously accepted any string for the URLs. A caller misconfigured with http://pkg.postguard.eu (typo, leaked dev config, etc.) would send their PostGuard API key as a Bearer token over plaintext — exactly the failure mode an IBE SDK should fail closed on.

Test plan

• dotnet build E4A.PostGuard.slnx --configuration Release — green locally
• dotnet test E4A.PostGuard.slnx --configuration Release — 13/13 pass
• CI green on this PR

Notes

• CI's build.yml does not currently invoke dotnet test. The bot doesn't have the workflows permission to update it in this PR; a follow-up will wire the test step in.
• Behaviour change: any caller currently passing an http:// URL will now hit ArgumentException on new PostGuard(config). The README only documents the production https:// URL, so this should be an empty set in practice — but worth flagging.

Reviewer quickstart

git fetch origin && git checkout fix/validate-https-urls && dotnet test E4A.PostGuard.slnx --configuration Release