Add --secure-source option

This option can override the insecure sources check against http:// and
git:// sources. It allows specific url prefixes (such as an internal git
mirror) to be excluded from the check.

@postmodern I noticed you rejected a similar pull in #37, but please reconsider. I think it is sufficient for the insecure source check to just be a default - there are legitimate reasons to use git:// sources. In my company's case, we use an internal git:// mirror in part for performance reasons, which is still arguably more secure than any 3rd party source.