Is your feature request related to a problem? Please describe.
There are about 80 port files (*.cmake) that contain links to resources using 'http' instead of 'https', which opens up an opportunity for eavesdropping or network tampering.

Proposed solution

1. Review each of the port files and upgrade http to https wherever possible. (Meaning, if the same content comes back for http://foo and https://foo, then the URL is upgradeable.)

2. The vcpkg port validation (CI) check could check to fail or warn for upgradeable http URLs.

Describe alternatives you've considered
The vcpkg tool itself could attempt to load http URLs via https, but this could break things, as there's no guarantee the same content would come back.

Additional context
I'd be happy to contribute a PR with the validated changes for the first item above, and the script used to make those changes.