fix: align proxy transport requirements

[sachaservan]

Summary by cubic

Align proxy transport rules by allowing http proxies for EHBP and enforcing strict origin binding (scheme, host, port) to prevent header disclosure. base_url is now optional and URLs are validated more strictly.

• Bug Fixes
  • Accept http base_url for EHBP; keep attestation_bundle_url https-only.
  • Validate base_url/attestation_bundle_url as absolute http(s) URLs; reject malformed or non-HTTP schemes.
  • Enforce exact origin binding for enclave/proxy (scheme, host, port), including correct defaults for 80/443; block unconfigured HTTP and foreign hosts.
  • In tls transport, require base_url to match the verified enclave origin; otherwise raise.
  • Make base_url Optional in SecureClient/NewSecureClient and avoid adding the enclave URL header when proxy and enclave share the same origin.

^{Written for commit 26c865f. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>