Adds TODOs, puts back UmbracoRequireHttpsAttribute but in a nicer way, ensures test classes initialize the authz policies with the test scheme

src/Umbraco.Web.Common/Controllers/UmbracoApiController.cs

@@ -7,6 +7,8 @@ namespace Umbraco.Web.Common.Controllers
     /// </summary>
     public abstract class UmbracoApiController : UmbracoApiControllerBase, IDiscoverable
     {
+        // TODO: Should this only exist in the back office project? These really are only ever used for the back office AFAIK
+
         protected UmbracoApiController()
         {
         }

src/Umbraco.Web.Common/Controllers/UmbracoApiControllerBase.cs

@@ -19,6 +19,8 @@ namespace Umbraco.Web.Common.Controllers
     [UmbracoApiController]
     public abstract class UmbracoApiControllerBase : ControllerBase, IUmbracoFeature
     {
+        // TODO: Should this only exist in the back office project? These really are only ever used for the back office AFAIK
+
         public UmbracoApiControllerBase()
         {
         }

src/Umbraco.Web.Common/Controllers/UmbracoApiControllerTypeCollectionBuilder.cs

@@ -5,6 +5,8 @@ namespace Umbraco.Web.Common.Controllers
 {
     public class UmbracoApiControllerTypeCollectionBuilder : TypeCollectionBuilderBase<UmbracoApiControllerTypeCollectionBuilder, UmbracoApiControllerTypeCollection, UmbracoApiController>
     {
+        // TODO: Should this only exist in the back office project? These really are only ever used for the back office AFAIK
+
         protected override UmbracoApiControllerTypeCollectionBuilder This => this;
     }
 }