Prefer HTTPS protocol over HTTP when fetching translations

I agree with making this change, is has been applied to Localization Update module too.

Just like we did in l10n_update, lets add an update script to update the configuration from 'http' to 'https' if the config has the default value.
See https://www.drupal.org/node/2907795#comment-12261794

Thanks, for the addition. In general it looks good, just a few nits:

1. +++ b/core/modules/locale/locale.install
   @@ -304,3 +304,13 @@ function locale_update_8300() {
   + * Update default variable values to use https.
   + */
   

   This sentence is all a developer / dev-ops gets to understand what the update function does. I suggest:
   Update default server pattern value to use https.

2. +++ b/core/modules/locale/locale.install
   @@ -304,3 +304,13 @@ function locale_update_8300() {
   +    \Drupal::configFactory()->getEditable('locale.settings')->set('translation.default_server_pattern', LOCALE_TRANSLATION_DEFAULT_SERVER_PATTERN)->save();
   

   For readability I propose the more compact:

   \Drupal::configFactory()->getEditable('locale.settings')
     ->set('translation.default_server_pattern', LOCALE_TRANSLATION_DEFAULT_SERVER_PATTERN)
     ->save();

No more comments, I think this is ready to go. Tested the module and checked the code.

Because the change from http to https has only value when used in the field, I see no reason to add a test to this patch.
Patch currently applies to both 8.4.x and 8.5.x

Excellent issue report! It explains the need for the fix quite clearly.

Usually we don't commit things that require update hooks to the production branch except for serious bugs due to the potential disruption (reference: https://www.drupal.org/core/d8-allowed-changes#disruption). I'll check with another committer for a second opinion on this.

Alright, chatted about this a bit with @larowlan and since this isn't affecting the actual security of the request nor adding extra load, we agreed to add it to 8.5.x only, which means we should also rename that update hook. Thanks!

RTBC = Checked code && Tests passed.

Very good patch, agreed with the issue summary being very concise also. Love to work with issues like this :)

+++ b/core/modules/locale/locale.install
@@ -304,3 +304,15 @@ function locale_update_8300() {
+      ->set('translation.default_server_pattern', LOCALE_TRANSLATION_DEFAULT_SERVER_PATTERN)

As a general rule, we don't rely on outside factors in update functions because then if the constant is changed in a later release, the result of this update function will be different for people running it with that release vs. with an older release.

While this is not very likely, it could still happen. So we should inline the desired new value as well for that reason.

Checked the content of the interdiff, checked that it is the same string as is used in the different places in the patch.

Alright, looks good. Committed and pushed to 8.5.x. Thanks!