Set X-Forwarded-Proto header for Ceph dashboard SAML authentication

Dashboard runs with ssl: false behind TLS-terminating proxy, so SAML
library sees http:// URLs and rejects responses expecting https://.
Explicitly set X-Forwarded-Proto: https on both Istio VirtualService
and Envoy Gateway HTTPRoute so the SAML ACS URL matches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/rook-ceph/manifests/istio-virtualservice.yaml

@@ -9,7 +9,11 @@ spec:
   gateways:
     - istio-system/edge
   http:
-    - timeout: 3600s
+    - headers:
+        request:
+          set:
+            x-forwarded-proto: https
+      timeout: 3600s
       route:
         - destination:
             host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local