fix(healthcheck): enforce http and https url scheme in check_http

[vaibhavsrv]

Why this matters

In ods/scripts/healthcheck.py, check_http() is exported and invoked programmatically by test runners, diagnostic monitors, and extension health checkers. When given a target URL, _http_request() passes it directly to urllib.request.urlopen. Because urllib natively supports multiple non-HTTP URI handlers (file:, ftp:, data:), passing a non-HTTP target (e.g. file:///etc/hosts or ftp://...) causes urllib to open local filesystem resources or initiate non-HTTP protocols rather than rejecting the target as an invalid HTTP endpoint, violating Bandit B310 guidelines.

This change adds an explicit scheme check at the entry of check_http(), returning (False, "url scheme must be http or https", None) if the scheme is not http:// or https://. Legitimate HTTP/HTTPS probing, status code checking, and body regex matching remain untouched.

Validation

• Baseline reproduction: Calling check_http("file:///etc/hosts", ...) opened the local file and returned (False, "http GET: missing status", None) rather than rejecting the invalid protocol scheme.
• Post-fix verification: Running ods/tests/test_healthcheck_scheme_guard.py confirms that file:, ftp:, gopher:, and data: URLs are cleanly rejected with "url scheme must be http or https" and exit code 0.
• Telemetry: Healthcheck test suite passes: test_healthcheck_scheme_guard.py passes cleanly (exit code 0). Wired into Linux CI workflow under the healthcheck test step.

Overlap check

• fix(healthcheck): support bracketed IPv6 targets and strip brackets before TCP connect #5875 (merged today): Added bracketed IPv6 support to healthcheck.py. This change focuses strictly on URL scheme validation in check_http().
• fix(healthcheck): strip whitespace in parse_target and validate host #5950, fix(healthcheck): guard negative or zero timeout in check_tcp and check_http #5951: Addressed whitespace stripping in parse_target and timeout parameter bounds. This PR operates orthogonally on protocol scheme filtering.
• Does not alter HTTP redirect policies or status code parsing.

Risk / AI disclosure

AI-assisted investigation, implementation, and test regressions. This reinforces URL protocol scheme boundaries in health checking. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #5875, #5950, #5951, #6076, and #6077 at HEAD without conflicts. Production and test diffs passed together; healthcheck IPv6 and redirect policy suites remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.