Path imports from remote URLs don't currently work on Windows

[ElvenSpellmaker]

If you have a config:

import:
 - http://foo.bar/baz.yaml

and that looks like:

import:
 - /tmp/foo.yaml

On windows the file is like:

import:
 - C:\tmp\foo.yaml

It seems this passes on Unix but on Windows it doesn't as it tries to parse the incoming import directory of http: with the path: filepath.Dir(file) where file is the link from the first import: http://foo.bar/baz.yaml.

This results in:

• Unix: http://tmp/foo.yaml
• Windows: http:/C:\tmp\foo.yaml

This is then passed as path.IsAbs(val) which returns true for Unix but false for Windows.

For Unix this then basically strips the erroneous http: prefix and uses it as a file, but for Windows it tries to os.Stat() on an invalid file http:/C:\tmp\foo.yaml

It feels the logic is a bit messed up here potentially, what is the intention of the Isabs here?

NOTE: Also this raises a security question, should we allow remote imports to import at all? Importing from the web could be potentially dangerous, and importing from file could be dangerous if there's an exploit in the YAML parser? Just a thought.