Remove FTP support

[domenic]

It seems Chrome and Firefox are both removing FTP support.

Potentially impacted parts of the spec:

• Scheme fetch
• Network scheme: maybe this can be removed in favor of "HTTP(S) scheme"? Or rename "HTTP(S) scheme" to "network scheme"? Unsure what this impacts.
• Bad port blocking (connected to network scheme)
• Main fetch step 2.8 appears to be attempting to network-error some FTP requests. If we instead network-error all FTP requests then this step can probably be deleted.

[bakkot]

Network scheme: maybe this can be removed in favor of "HTTP(S) scheme"? Or rename "HTTP(S) scheme" to "network scheme"? Unsure what this impacts.

"Network scheme" is used at least in CSP, so that e.g. script-src * allows loading scripts hosted on http://example.com, https://example.com, and ftp://example.com, but does not allow <script src="data:text/javascript,alert(1)"></script>.

[domenic]

Makes sense. But after removing FTP from browsers, it seems CSP could just replace that with HTTP(S) scheme. (Or we could replace all uses of HTTP(S) scheme with network scheme.)

[bakkot]

Yup, that's my reading too. That change would be observable, because it will mean that <script src="ftp://example.com"> on a page with script-src * will start triggering a user-observable CSP violation event, but that seems fine.

[annevk]

I'd be inclined to remove "network scheme" and only have "HTTP(S) scheme" as any new kind of protocol would require a lot of changes anyway (and has a much higher bar to clear than FTP). If anything still requires safelisting "ftp" for compatibility reasons they could do so explicitly to indicate the legacy need.