Enforce HTTPS-only in RequestCostPublisher (refuse, don't warn)

Parent

Part of #36927.

Problem

RequestCostPublisher.java:124-139 only warns if REQUEST_COST_PUSH_URL isn't https:// — it doesn't refuse to send. TLS holds today only because config happens to be correct, not because the code enforces it. This matters more once the collector accepts traffic that could originate outside OVH's own network (see #36927).

Change

Reject (fail validation at startup / no-op the publisher, matching the existing "both push vars set ⇒ activate" pattern) if REQUEST_COST_PUSH_URL's scheme isn't https, instead of logging a warning and sending anyway.

No env var changes — production config is already https://, so this is a pure guardrail, not a behavior change for anyone configured correctly.

Design reference

ADR-0022 (dotCMS/platform-adrs#73) and docs/plan-request-cost-provider-attribution.md §3.1 in dotCMS/ovh-k8s-cluster.

Start at RequestCostPublisher.java:124-139 and inspect the existing “both push vars set ⇒ activate” validation path. Ensure a non-https REQUEST_COST_PUSH_URL refuses activation or sending, while an https URL remains unchanged; verify the startup validation or no-op behavior using the relevant existing tests if present.