Permit cleartext for .onion addresses

The Tor and Onion service protocols provide encryption and authentication
respectively. Since Domain Validation certificates aren't currently being
issued for .onion addresses, the HTTPS requirement makes Element practically
incompatible with homeservers operated by individuals on Tor.

Signed-off-by: Martin Häger <martin.haeger@gmail.com>

CHANGES.md

@@ -5,6 +5,7 @@ Features ✨:
  -
 
 Improvements 🙌:
+ - Allow non-HTTPS connections to homeservers on Tor (#2941)
  - Fetch homeserver type and version and display in a new setting screen and add info in rageshakes (#2831)
  - Improve initial sync performance (#983)
  - PIP support for Jitsi call (#2418)

vector/src/main/res/xml/network_security_config.xml

@@ -11,6 +11,8 @@
         <domain includeSubdomains="true">127.0.0.1</domain>
         <!-- Localhost for Android emulator -->
         <domain includeSubdomains="true">10.0.2.2</domain>
+        <!-- Onion services -->
+        <domain includeSubdomains="true">onion</domain>
     </domain-config>
 
     <debug-overrides>