If you have site on https and run php server on http the function get_site_icon_url return a link with https.

I think the problem here https://github.com/WordPress/WordPress/blob/master/wp-includes/general-template.php#L810, because WordPress should use here get_site_url() instead get_option( 'site_icon' ).

Maybe we can add filter on get_site_icon_url to fix it problem or we should fix it in WordPress?