pub fn validate_url_scheme(url: &str) -> Result<()>
Validate that the given URL has an allowed scheme (http or https only). Rejects file://, javascript:, data:, blob:, and any other scheme.