Set X-Forwarded-Proto header for Ceph dashboard SAML authentication

Dashboard runs with ssl: false behind TLS-terminating proxy, so SAML
library sees http:// URLs and rejects responses expecting https://.
Explicitly set X-Forwarded-Proto: https on both Istio VirtualService
and Envoy Gateway HTTPRoute so the SAML ACS URL matches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/rook-ceph/manifests/envoy-route.yaml

@@ -17,6 +17,12 @@ spec:
         - path:
             type: PathPrefix
             value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Proto
+                value: https
       backendRefs:
         - group: gateway.envoyproxy.io
           kind: Backend