Explicitly check api_root_url is https

[gbossert]

This PR introduces validations to prevent non-https urls for api_root_url on:

• the creation of the modular input
• the setup configuration page