Relax validation for schemas with `source` field

[robhudson]

Basket doesn't validate source_urls strictly, so we've noticed some failures from CTMS with values of source being just the host without the URL scheme (https://).

Basket could validate these, but it doesn't seem necessary that these are strictly valid URLs.