fix(gateway-interceptors): apply tls-native-roots for HTTPS interceptor endpoints (#2666)

* fix(gateway-interceptors): apply tls-native-roots for HTTPS interceptor endpoints

Endpoint::connect() does not apply TLS configuration automatically
for https:// URLs even with tls-native-roots feature enabled. Add
explicit .tls_config(ClientTlsConfig::new()) when the endpoint uses
HTTPS so tonic uses the system's native root certificate store.

Fixes #2665

* fix(gateway-interceptors): detect parsed HTTPS scheme

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

---------

Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Co-authored-by: Drew Newberry <anewberry@nvidia.com>

Author: sauagarwa

crates/openshell-gateway-interceptors/src/plan.rs

@@ -19,7 +19,7 @@ use openshell_core::proto::gateway_interceptor::v1::{
 use tokio::net::UnixStream;
 use tonic::Request;
 use tonic::codegen::http::Uri;
-use tonic::transport::{Channel, Endpoint};
+use tonic::transport::{Channel, ClientTlsConfig, Endpoint};
 use tower::service_fn;
 use tracing::{info, warn};
 
@@ -862,11 +862,19 @@ async fn connect_endpoint(endpoint: &str) -> Result<Channel> {
     if let Some(path) = endpoint.strip_prefix("unix://") {
         return connect_unix_endpoint(PathBuf::from(path)).await;
     }
-    Endpoint::from_shared(endpoint.to_string())
-        .map_err(|e| {
-            InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}"))
-        })?
-        .connect()
+    let mut ep = Endpoint::from_shared(endpoint.to_string()).map_err(|e| {
+        InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}"))
+    })?;
+    if ep.uri().scheme_str() == Some("https") {
+        ep = ep
+            .tls_config(ClientTlsConfig::new().with_enabled_roots())
+            .map_err(|e| {
+                InterceptorError::Config(format!(
+                    "TLS config for interceptor endpoint '{endpoint}': {e}"
+                ))
+            })?;
+    }
+    ep.connect()
         .await
         .map_err(|e| InterceptorError::Transport(format!("connect {endpoint}: {e}")))
 }