Add tests

  * Catalog item does not leak bundles to child catalog items
  * Catalog item DOES leak bundles to URL referenced YAMLs
Log a warning

in case the protocol of a url referenced YAML is not white listed