fix: require HTTPS for Redmine URL

Config.validate() now rejects REDMINE_URL values whose scheme is not
HTTPS (http://, missing scheme, or any other scheme). The API key is
sent in request headers, so a plain-HTTP endpoint would expose it.
Scheme comparison is case-insensitive per RFC 3986.

Closes #54

redmine_reporter/config.py

@@ -398,8 +398,14 @@ class Config:
 
     @classmethod
     def validate(cls) -> None:
-        if not cls.get_redmine_url():
+        url = cls.get_redmine_url()
+        if not url:
             raise ValueError("REDMINE_URL is required (set via env or .env)")
+        if not url.lower().startswith("https://"):
+            raise ValueError(
+                "REDMINE_URL must use HTTPS: the API key is sent in request "
+                "headers and requires TLS"
+            )
         if cls.get_redmine_api_key():
             return
         if not (cls.get_redmine_user() and cls.get_redmine_password()):