rhdh addon: HTTP Route unusable in a browser with default RHDH CSP

[jasonmadigan]

What

oinc addon install rhdh exposes RHDH over a plain-HTTP Route (http://rhdh.127.0.0.1.nip.io:9080). RHDH's default Content-Security-Policy includes upgrade-insecure-requests, so the browser upgrades every subresource fetch (JS bundles, assets) to https on that origin and gets ERR_SSL; the app never loads. The addon's curl readiness check passes because plain document fetches are unaffected, so the breakage is invisible until a real browser hits it. localhost is exempt from the upgrade behaviour, which is why port-forward flows never showed it; a real hostname like nip.io is not.

Found running Playwright against the addon-installed RHDH in kuadrant-backstage-plugin (PR #348): 7 console errors and a blank app, dropping to 0 errors with a sign-in page rendered once the consumer overlay sets backend.csp.upgrade-insecure-requests: false. That workaround now lives consumer-side; it belongs in the addon.

Fix options

• Set backend.csp.upgrade-insecure-requests: false in the addon's base values when serving the HTTP Route. One line, matches the exposure the addon itself chose.
• Or serve an edge-TLS Route instead, keeping the default CSP intact. Cleaner, needs cert handling for the nip.io hostname.

Acceptance criteria

• A browser loads the addon-installed RHDH at the advertised Route URL with no CSP-induced asset failures, out of the box
• Readiness reflects browser usability, not just a curl 200 (a check that fetches an asset, or documented rationale)
• Consumers can delete their CSP override (kuadrant-backstage-plugin has one to remove)

[jasonmadigan]

Closing as intended behaviour: CSP is per-consumer configuration, not addon policy. The addon stays neutral and consumers that serve browsers over the HTTP Route set backend.csp.upgrade-insecure-requests: false in their values overlay (kuadrant-backstage-plugin does this in its rhdh install). The --rhdh-values hook is the supported mechanism; documenting the gotcha in the addon README is welcome if anyone trips on it again.