Set X-Forwarded-Proto header for Ceph dashboard SAML authentication

Dashboard runs with ssl: false behind TLS-terminating proxy, so SAML
library sees http:// URLs and rejects responses expecting https://.
Explicitly set X-Forwarded-Proto: https on both Istio VirtualService
and Envoy Gateway HTTPRoute so the SAML ACS URL matches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/rook-ceph/manifests/envoy-route.yaml

@@ -17,6 +17,12 @@ spec:
         - path:
             type: PathPrefix
             value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Proto
+                value: https
       backendRefs:
         - group: gateway.envoyproxy.io
           kind: Backend

infrastructure/rook-ceph/manifests/istio-virtualservice.yaml

@@ -9,7 +9,11 @@ spec:
   gateways:
     - istio-system/edge
   http:
-    - timeout: 3600s
+    - headers:
+        request:
+          set:
+            x-forwarded-proto: https
+      timeout: 3600s
       route:
         - destination:
             host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local