Add production runtime config to the missing HTTPS check

[LGuichet]

Phoenix HTTPS configuration is often done in the runtime.exs file.
The production related config is inside the following block
if config_env() == :prod do #...

When scanning for HTTPS enabling config, Sobelow only looks in the prod.exs file.
It should also be able to check into the runtime.exs file to avoid false-positives, idealy selectively inside the above code block

[houllette]

Hey @LGuichet! This sounds like a great add - do you have a code example or link to an open source project that has this type of configuration style I can test against?

[LGuichet]

While I could not find any applied exemple, it can be found in the template phoenix uses when generating fresh apps.
Here's the link to the runtime configuration file template

Runtime config has been introduced relatively recently with elixir v1.11 in 2020, and it aims amongst other things to phase out the release.exs file
Here's J.Valim v1.11 ElixirConf talk about it

[alvarezloaiciga]

Hi @houllette , I have raised a PR to fix this, at least for the https one #162