security: warn when server URL uses HTTP (credentials sent unencrypted)

[jacalata]

Problem

If a user specifies http:// explicitly as the server URL (e.g. tabcmd login --server http://tableauonline), tabcmd honours it and sends credentials in plaintext on the first request. There is no warning or prompt.

The or "https" fallback in session.py:_get_server_base_url only applies when the user omits the scheme entirely — it does not protect against an explicit http://.

Proposed fix

Log a warning in _get_server_base_url when parsed.scheme == "http":

if parsed.scheme == "http":
    self.logger.warning(
        "Server URL uses HTTP — credentials will be sent unencrypted. Use https:// instead."
    )

This doesn't prevent anything but gives the user honest disclosure before their credentials leave the machine.