The CalDAV collection_url validation only checked the scheme prefix,
so http://<remote-host>/... passed even though it sends the account's
Basic-auth credentials in cleartext. Reuse the same loopback-only rule
as the imap/smtp TlsMode::Plain check: plain http is now accepted only
when the URL's host is loopback (127.0.0.0/8, ::1, or localhost);
https to any host, and http to a loopback host, remain valid.
Refs #297
AccountConfig::validate silently accepted TlsMode::Plain for imap/smtp
against any host, so a misconfig could send credentials in cleartext
to a remote server. Plain is now rejected unless the host is loopback
(127.0.0.1, ::1, or localhost); ImplicitTls/StartTls are unaffected.
Refs #297
James Maes