Make mrpack downloads HTTPS-only (#5882)

* Add set of trusted download hosts for mrpacks

* split secure/insecure reqwest client

* make fetching https-only

* lint fix

packages/app-lib/src/api/profile/mod.rs

@@ -863,7 +863,7 @@ async fn run_credentials(
         if !project_id.trim().is_empty() {
             let server_id = uuid::Uuid::new_v4().to_string();
 
-            let join_result = fetch::REQWEST_CLIENT
+            let join_result = fetch::INSECURE_REQWEST_CLIENT
                 .post("https://sessionserver.mojang.com/session/minecraft/join")
                 .json(&json!({
                     "accessToken": &credentials.access_token,