Implementation of secure param for PageUrlAnnotation

There are a few things I am not 100% sure:
- should `$secure` always overwrite the protocol? even if it is not present.
- introduce `$secure` property and getter? Just now I alter the protocol to the current passed value of `$secure`
- comments of the new `$secure` param, quite a lot of information for a single line

Closes #63.
Ok at the end I personally think in the current state it would be enough to move the `normalize` tests here. We do indirectly test the functio. But in this scenario `Normalizer` won't be tested as standalone and if we remove it it will not be tested (which will lower the CC).

The other way would be to move the `Normalizer` creation to the `UrlFactory`. Then we can mock it for the test here. But prob. this just gives us some time till we encounter another problem.