fix(ocsf): report https scheme for TLS-terminated requests

[ericcurtin]

Summary

L7 OCSF HTTP events recorded http for TLS-terminated requests. Use the transport scheme.

Related Issue

Closes #4562

Changes

• Add L7EvalContext::ocsf_url, built from request_scheme.
• Replace the eight hardcoded "http" URL sites with it.
• Update sample log lines in docs.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo test, cargo clippy -D warnings and cargo fmt pass for openshell-supervisor-network.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@krishicks @matthewgrossman could you please accept #4562 so the issue check can pass? @pimlock PTAL, and /ok to test aff878e3be761e8e5a8f113dabba2412ae251881 if it looks good. Thank you!

[EmilienM]

Another iteration needed. The ocsf_url helper is a nice way to fix the inspected paths, but the passthrough relay still passes "http" to middleware and to the response-middleware OCSF event on TLS traffic (see inline on relay.rs). So #4562's "all L7 relay emission paths" isn't fully covered yet. Two small nits on the test and docs as well.

[ericcurtin]

Addressed review feedback. @EmilienM @pimlock PTAL, and /ok to test 749337f661158ff9240738c2ac45fb189ef5007d if it looks good. Thank you!

[TaylorMutch]

/ok to test 749337f

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

TLS-terminated L7 OCSF events change http_request.url.scheme from http to https and shorthand URLs from http://host:443/... to https://host/....

• Impact: SIEM filters, dashboards, and alerts matching scheme == "http" or the documented http://...:443 shorthand stop matching these TLS L7 events.
• Action: Preserve the baseline telemetry in v0.1.5, or move the semantic change to a minor train with notice and migration guidance for SIEM rules and shorthand parsers.
• PR: fix(ocsf): report https scheme for TLS-terminated requests #4684

Review details

• Execution: complete
• Candidate: PR #4684 (d0cbed1e38577435fcc5e572bd4b00ff3bd0461e)
• Baseline: 55bf786453395f3fe1858a187152537b457de77d (55bf786453395f3fe1858a187152537b457de77d)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[TaylorMutch]

Reviewed the transport-aware OCSF URL changes and passthrough middleware fixes. Branch Checks passed for this commit, including Rust tests on x86_64 Linux, ARM64 Linux, and macOS.