resourceloader: Remove support for `addSource(id, url)`

resourceloader: Remove support for `addSource(id, url)`

The PHP interface still supports it without deprecation, but there
is no need for the client to support it given it is only ever called
from the startup module, which always passes it an object.

Follows-up 6815e355753c, which did the same for `state(key, val)`.

Also simplify the implementation to avoid extra calls and optimise
for the only signature.

Mark the method as @private, and change the existing use of
@protected to @private (doesn't really make sense in JavaScript).

Change-Id: I24786f90bcfb256b2e7c37f7760bba1a5e399443