The correct thing to do is to not specify the protocol at all, like they do for the Vimeo shortcode in includes/shortcodes.php .
Change line 667 from:
$video .= 'src="https://www.youtube.com/embed/' ...
to:
$video .= 'src="//www.youtube.com/embed/' ...
This way, the request to YouTube will be made with the same protocol (HTTP or HTTPS) that the parent page was requested with.
