Created "Use-of-Unencrypted-URI-Schemes.bcheck" File.

[X] BCheck compiles and executes as expected
[X] BCheck contains appropriate metadata (name, version, author, description and appropriate tags)
[X] Only .bcheck files have been added or modified
[X] BCheck is in the appropriate folder
[X] PR contains single or limited number of BChecks (Multiple PRs are preferred)
[X] BCheck attempts to minimize false positives

This BCheck attempts to look for hard-coded uses of unencrypted URI schemes (http, ftp, ldap, smtp without STARTTLS).
To reduce FPs, I included checks for attributes within hard-coded URLs (such as ldap:// being fine if the discovered URL uses port 636).
I also included several scanned file types & hard-coded file types to ignore (the most being .svg file types & use of w3.org).
I included several known URLs to ignore, such as known JavaScript library/framework links (jQuery, momentjs, sizzlejs).
I have the list of all hard-coded indicators for FPs to ignore at the beginning of the file & will likely update it based on future testing.
FP prevention also includes checking for "Content-Type: image/".
As a unique FP test, I tried to add to the regex a way to ignore "commented-out" JavaScript code.
- URLs prior to / within 98 characters (98 to set a boundary that won't be too excessive) will not be detected unless / is also detected within 98 characters.
- This method isn't perfect, but works well enough; the unlikely event wherein the sequence / / /* is used will still result in commented code being detected.
I tested the file numerous times to ensure the Regex patterning was works as intended on my machine.

I thought I deleted this file already in my last pull request.
For reference, this is the original file that is a copy of "Content-Security-Policy.bcheck" in /archived.

Last minor edits to the "Content-Security-Policy.bcheck" (added tags & updated language to beta-v2).

PortSwigger / BChecks