Always use HTTPS for CDN files

[adamchainz]

There's no point using insecure, deprecated HTTP even if the current page is on HTTP.

[coveralls]

Coverage decreased (-0.01%) to 94.652% when pulling d1aecab on adamchainz:patch-1 into 9351626 on graphql-python:master.

[Amoki]

What about going one step further and adding the SHA hash of these js ?

[adamchainz]

Forgot that's a thing now. I don't have the time to do it here. But it's not possible for two files as they are templated by version with {{graphiql_version}}

[jkimbo]

Makes sense 👍

[danpalmer]

@adamchainz I reckon it's worth doing for the other files, as it reduces the potential attack surface area.

[adamchainz]

@danpalmer you're right

[adamchainz]

Thanks!