Require HTTPS in restricted HTTP builds

[waldemort-auto]

Summary

Restricted HTTP allow-list builds currently permit plaintext http:// requests. That can expose authorization headers, credentials, and request bodies in transit.

This change:

• requires HTTPS when http-allow-azure-domains or http-allow-test-domains is enabled;
• preserves HTTP and HTTPS support for development-only http-allow-all builds;
• applies the same scheme policy during DSL construction and execution, including raw HTTP and multipart nodes;
• keeps existing SSRF checks authoritative by updating bare-IP test vectors to HTTPS;
• documents the feature-dependent transport policy and records the fix for issue df.http() permits credentials over plaintext HTTP to allow-listed domains #342.

Validation

• git diff --check
• SQL regression coverage added for regular, multipart, raw-node, and allow-all paths
• Feature-specific Rust unit tests added for restricted, allow-all, and HTTP-disabled builds

Cargo-based validation could not run in the repo-cache environment because cargo is unavailable (bash: line 1: cargo: command not found).

[Pino de Candia (pinodeca)]

Reviewed with Opus 4.8, no issues found.