Make using insecure connections opt-in

[tadeohepperle]

Fixes #1239

To use insecure (no SSL, ws:// or http:// connections) one now has to:

• use OnlineClient::from_insecure_url when constructing an online client
• use LightClientBuilder::build_from_insecure_url when creating a light client
• add the --allow-insecure flag to most commands in the CLI tool

Note: localhost is considered secure and does not need this opt in.

[niklasad1]

LGTM, added some minor suggestions

[jsdw]

This looks great!

A couple of places left that this should probably also be added to:

• RpcClient struct: add RpcClient::from_insecure_url and make from_url not allow insecure.
• #[subxt] macro: rename runtime_metadata_url to runtime_metadata_insecure_url? it's a dev only option, so I don't really care about complicating anything by doing the proper check, but might be worth following the naming convention (and adding the word insecure might put people off using it a bit which would be a good thing anyway :))