fix(be): keep loopback http gated by explicit allowlist under sso_allow_any_domain

[aterga]

Addresses the review comment on #4045 (#4045 (comment)).

Problem

Hop-1 of SSO discovery chooses its scheme via scheme_for_allowlisted_host, which keyed only on whether the host was loopback (localhost / 127.0.0.1) — it never consulted the allowlist. That was safe only under the prior invariant that every domain reaching discovery was already explicitly allowlisted.

sso_allow_any_domain breaks that invariant: with the flag on, is_allowed_discovery_domain accepts any domain, so a non-allowlisted localhost / 127.0.0.1 now reaches hop-1 and gets a plain-http:// outcall. That is an SSRF/footgun for staging deployments and contradicts the flag's stated "strict-https posture untouched" goal.

Fix

Gate the loopback http downgrade on explicit allowlisting (the same gate hop-2 already uses), so the flag opens the domain gate but never relaxes https:

if matches!(bare.as_str(), "localhost" | "127.0.0.1") && is_explicitly_allowlisted(host) {
    "http"
} else {
    "https"
}

• A loopback host reachable only via the flag (not on the explicit allowlist) now gets https — no plain-HTTP outcall to loopback.
• The e2e provider localhost:11107 stays on the explicit sso_discoverable_domains allowlist, so its http path is unaffected (no e2e regression).
• Adds regression unit test allow_any_domain_does_not_relax_https_for_loopback.

Note: this is stacked on feat/sso-allow-any-domain; it can also just be cherry-picked as a single commit onto that branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LDnAektYFmpUWDHPLHypkQ

---

Generated by Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 001692f.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=361d84ae-2f59-4be5-b2ae-0387c10bc368&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Refactor	► src/internet_identity/src/openid/sso.rs     Refine logic for determining the scheme for the hop-1 URL to handle explicitly allowlisted loopback hosts and the sso_allow_any_domain flag.