Add permissions to allow rules to be loaded from anywhere

By whitelisting all http and https URLs, we can load our rules from
anywhere, without having to worry about the CORS headers being set.
This allows us to host the rules.json on AWS S3 (e.g.
https://s3-eu-west-1.amazonaws.com), GitHub (e.g.
raw.githubusercontent.com) and GitHub Gists (e.g.
https://gist.githubusercontent.com) to name a few.