When you migrate your web site from HTTP to HTTPS with the sole reason of gaining the HTTPS Google ranking boost - okay, you can have other reasons, then you must also make sure your disavow file is accessible on the HTTPS version.
Google's Gary Illyes confirmed this was the case on Twitter when Annie Cushing asked him to verify that was the case.
Gary said, "yes, you need to reupload the disavow file to the https site profile in SC."
Here is the set of tweets:
If you do your site move correctly, all your HTTP stuff should be converted to HTTPS anyway, so the disavow would be included.
Forum discussion at Twitter.