YoutubeOnebox: FIX HTTP-specific URLs

by replacing with protocol-agnostic URLs.
This fixes the mixed-content warning for secure instances of discourse, at least for Youtube
Merge pull request #1514 from cfstras/youtube-https

YoutubeOnebox: FIX HTTP-specific URLs