Do I have buy an SSL certificate to use https://myapp.appspot.com, or is it free of charge ?
No you don't have to bring your own certificate - appspot.com's SSL certificate is a wildcard SSL certificate that covers all the subdomains. In fact you can't bring your own certificate anyway.
Yes, the SSL certificate service provided by appspot.com is free, but check up on pricing models (by default, secure requests/traffic are counted same as normal bandwidth)
Pricing quotas for AppEngine: http://code.google.com/appengine/docs/quotas.html
See more information about using Secure URLs: http://code.google.com/appengine/docs/java/config/webxml.html#Secure_URLs