Restrict direct url installs to the file:// scheme

[Rylan12]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

We already don't allow installing or loading formulae directly from a URL (e.g. brew install https://example.com/foo.tar.gz), so this PR extends that to casks and also strengthens the check to ensure that the file:// URL scheme is the only one allowed by FromURILoader.

Additionally, this PR does not allow loading formulae directly form a bottle URL (except for a file:// URL).

I've opted to still have this return an error message like is currently done, but we also could put a deprecation there and eventually just have Formulary.loader_for("https://...") go right to NullLoader.

[Rylan12]

Actually, it looks like #17695 removes the URI stuff from FromBottleLoader anyway which removes the need for some of this. If that gets merged first, I'll rebase here.

[MikeMcQuaid]

Actually, it looks like #17695 removes the URI stuff from FromBottleLoader anyway which removes the need for some of this. If that gets merged first, I'll rebase here.

Just merged it, thanks @Rylan12!

[woodruffw]

Needs deconflict but LGTM, thanks @Rylan12!