Require a secure connection when using the Push API

Wording could probably use some tweaking, open to suggestions.

We don't need to modify the algorithms of `isRegistered` and `unregister` because there won't be any live registrations for non-https origins. When `hasPermission` will be introduced to the specification, we can bail early in its steps for non-https origins.