Warn on url values new URL() accepts but are not real URLs; default to http/https - #1220

@type=url validates with new URL(), which accepts any word:rest string as a URL with an opaque path. A user hit this with an SSH key fingerprint (SHA256:nThbg6... parses as scheme sha256:), and the same goes for user:pass, localhost:3000, and C:\path. For http/https the parser also silently repairs malformed input (https:///example.com, http://0x7f.1, https://a..b), and it strips whitespace the raw value still carries.

This PR adds those checks as warnings, to become errors in the next major (one constant, STRICT_URL_SEVERITY, marked TODO(next major)). A value is flagged if it:

• does not start with scheme://
• contains whitespace or control characters
• has no host (special schemes always need one; others can opt in with the new allowNoHost=true for sqlite:///app.db, file:///..., postgresql:///db?host=...)
• for http/https/ws/wss/ftp: uses a backslash, a percent-encoded host, IPv4 shorthand, or a hostname with empty or hyphen-edged labels

It also warns when the protocol is not http/https and allowedProtocols is not set, since the next major makes http/https the default. The tip names the fix (allowedProtocols=[postgres]), and the new allowedProtocols="*" allows any protocol.

The VSCode extension shows the same checks as warnings, and completes allowNoHost. Docs describe the checks with a caution about the next major; the DATABASE_URL examples in the guides now set allowedProtocols, and the README example (API_URL=localhost:${API_PORT}, which only passed because of this) uses http://.

Two supporting fixes so these warnings stay advisory: a type's validation result that contains only warnings no longer stops the checks after it (the sensitive-value length checks still run), and nested validation errors in array/record keep their severity instead of being rewrapped as errors.