thumbnails: force HTTPS for youtube, imgur, vimeo

 * other services also provide thumbs over HTTPS, but the rewrite expression is more complex, so left out for now