fix(common): use hybrid URLs to import 3rd-party fonts

This makes possible loading external webfonts through SSL.