add note about third-party JS, CDNs, and HTTPS

I propose that we document/explain our use of HTTPS instead of protocol-relative URLs. There will inevitably be questions/issues about this; it will be nice to have something to point people to.
/cc @mdo @juthilo