I've used this for a few months now. It ugrades non-https connections on secure pages automatically. Very useful. Even big sites like microsoft, google images serve things over http
I was interested in this as well. Unfortunately, excluded sites are configured using PermissionManager <https://bugzilla.mozilla.org/1640853> which stores data in permissions.sqlite.
dom.security.https_only_mode = true