client: validate URI scheme in BaseRequest

[RinZ27]

PR Prelude

Thank you for working on YCM! :)

Please complete these steps and check these boxes (by putting an x inside
the brackets) before filing your PR:

• I have read and understood YCM's CONTRIBUTING document.
• I have read and understood YCM's CODE_OF_CONDUCT document.
• I have included tests for the changes in my PR. If not, I have included a
  rationale for why I haven't.
• I understand my PR may be closed if it becomes obvious I didn't
  actually perform all of these steps.

Why this change is necessary and useful

Enhancing the robustness of URI construction in base_request.py by validating the resulting scheme. Currently, _BuildUri uses urljoin which can return schemes like file:// if a handler name is manipulated. Since urllib.request.urlopen supports various protocols, adding a strict validation to allow only http and https prevents potential misuse of the request client for local file access or other unintended schemes.

Validation at the _BuildUri level ensures that all communication with the ycmd server stays within the expected HTTP(S) protocol boundaries. This change aligns with technical best practices for handling dynamic URL construction even in local environments.

Tests in BaseRequestTest now verify both successful URI building with valid schemes and the expected failure when an invalid scheme is detected.

---

This change is 

[puremourning]

Thanks for sending a PR, but I'm struggling to see what this actually protects against or why. Please can you elaborate a way in which this change would provide a real benefit?

[RinZ27]

@puremourning Thanks for the feedback. The primary goal here is defense in depth. urllib.request.urlopen supports several protocols like file:// or ftp:// by default, and urljoin will return the second argument if it looks like an absolute URL.

While our current handlers are hardcoded, this strict validation ensures we only ever talk over HTTP/HTTPS. It acts as a safeguard against potential local file access or unintended redirects if a handler name were ever influenced by external data or if a dynamic handler is introduced in the future. Verified the changes with the added tests in BaseRequestTest.