fix: secure Copilot API endpoint transport

[jbg]

Summary

• reject malformed and remote plaintext Copilot API endpoints from fresh token responses, memory, and legacy disk cache
• permit only exact loopback HTTP as a compatibility exception, with proxies disabled and redirects confined to HTTPS or loopback
• route both inference and model discovery through the same authenticated transport policy

Security impact

The Copilot token service controls the inference endpoint that receives the live Copilot bearer plus prompts, tool results, and images. Goose previously cached and used remote http:// endpoints without validation, allowing a misconfigured or compromised service plus an on-path observer to expose credentials and model traffic. This change enforces HTTPS across the initial request and redirects, while keeping a transport-confined loopback exception.

Closes project-loupe/audit-goose#726 after post-merge verification.

Verification

• cargo fmt --all -- --check
• cargo test -p goose --lib githubcopilot (18 passed)
• cargo test -p goose-providers api_client (11 passed)
• cargo build -p goose
• cargo clippy -p goose -p goose-providers --all-targets -- -D warnings
• git diff --check

Coverage includes endpoint policy, fresh responses, unexpired legacy cache, loopback model listing, HTTPS-only enforcement, environment-proxy bypass, and 307/308 redirect confinement.

This finding was discovered by Project Loupe.

[DOsinga]

This applies the endpoint transport policy consistently to fresh token responses, cached state, inference, and model discovery. The loopback compatibility path disables proxies and confines redirects, while remote endpoints require HTTPS. The added tests cover the important cache, proxy, redirect, and model-listing cases. CI is green.

LGTM.