[snapshot] Stop the safe HTTP client from skipping TLS verification

[kkozoriz]

Problem

SafeClient.SetTLSCAData (pkg/libsaferequest/client) merged a trust pool - system roots, the supplied CA, the kubeconfig CA - but never reset the caller's inherited insecure-skip-tls-verify / tls-server-name. With Insecure still set, Go skips certificate verification entirely no matter how large RootCAs is, so on the d8 data export/import transports the kubeconfig bearer token was handed to whatever endpoint answered that address.

This is the shared pkg/libsaferequest twin of the fix made for internal/snapshot/transport in #462. Stacked on #463.

Fix

• Force Insecure = false and clear ServerName unconditionally - on the rest.Config and on the transport clone, because client-go bakes the insecure flag into the base transport before WrapTransport runs.
• Chain a previously installed WrapTransport instead of clobbering it.
• Return the input RoundTripper for non-*http.Transport types instead of a typed-nil *http.Transport that nil-panics on RoundTrip.

Before / After

Probe: a rest.Config with insecure-skip-tls-verify: true and a bearer token, SetTLSCAData(nil) exactly as the publish path calls it, pointed at a self-signed TLS server that is in no trust store.

BEFORE (f9063c791)

probe: safe HTTP client against an untrusted TLS endpoint
  kubeconfig    : insecure-skip-tls-verify: true, bearer token set
  publish path  : SetTLSCAData(nil)  (ingress cert, no CA to pin)
  endpoint      : https://127.0.0.1:61064  (self-signed, in no trust store)

  request       : HTTP 200 OK
  body          : impersonated exporter payload
  endpoint read : Authorization: Bearer d8-demo-toke...

  VERDICT: LEAKED - certificate verification never ran, the token was handed over

AFTER (68ba3d1f1)

  request       : rejected
  error         : basic/token auth do request: Get "https://127.0.0.1:61073/data":
                  tls: failed to verify certificate: x509: certificate signed by unknown authority

  VERDICT: SAFE - the certificate was verified and the token was never sent

Validation

The probe above is built from the same source in two isolated git worktrees, one at each commit, and run in both - so the only difference is this diff. The exploit was also reproduced by hand against both trees during review.

Tests

• pkg/libsaferequest/client/http_test.go - verification forced on for nil / valid / kubeconfig CA data, invalid CA bytes, client cert survival, WrapTransport chaining, repeated calls, non-transport pass-through