Clear the req->wrk while holding the oh mutex, to close a race
against the busy-list.

Fixes #1342
Take a stab at #1341
By default ignore an <esi:include> with src="https://..."

Feature +esi_ignore_https treats it as http://... instead.

Default is "safe" in order to not expose any data by accident.

Fixes #1333