refuse secure cookies planted over a plaintext connection

[jmestwa-coder]

ThreadSafeCookieStore.add ignores the scheme a Set-Cookie arrived on, so anyone on the plaintext path of http://example.com can plant or replace the cookie the site only ever sets inside TLS and the next https request carries it back (RFC 6265bis section 5.7, steps 14 and 22, the Strict Secure Cookies rules browsers and curl apply):

• a cookie with the Secure attribute is stored even when the response came over http
• a non-Secure cookie received over http overwrites an existing Secure cookie of the same name, and a Max-Age=0 one deletes it
  Both checks now live in add(), keyed on the request URI scheme and placed before the expiry branch; the path test is one-way as the spec asks, so a non-Secure cookie for /foo is still fine next to a Secure one for /login. SecureCookieSchemeTest covers the three rejections and the unchanged https and plain-http cases.