[Feature] Terminate TLS in front of a product in CI so the HTTPS/SSL suites can run

Child of #409 (robust CI/CD epic). Split out of #540.

security/test_https.py and cross_product/test_ssl.py can never run in CI as things stand, because both bail out unless the product URL is HTTPS:

src/vip_tests/security/test_https.py:48    if not pc.url.startswith("https://"):
src/vip_tests/cross_product/test_ssl.py:40  if parsed.scheme != "https":

The containers the smoke workflows stand up serve plain HTTP, so adding these files as-is would produce a green run made entirely of skips — the same green-with-no-coverage pattern #421 was about. They need TLS terminating in front of a product before they mean anything.

Between them these cover

• HTTP-to-HTTPS redirect enforcement (test_https).
• Certificate validity, including expiry (test_ssl).
• That plain HTTP is not silently served alongside HTTPS.

Worth having: TLS misconfiguration is a common real-world install problem, and these are the only tests that check it.

Scope

• Terminate TLS in front of one containerized product — Connect is the natural choice, since connect-smoke.yml is already the richest workflow.
• A reverse-proxy sidecar (Caddy or nginx) with a self-signed cert is the obvious approach; Caddy needs the least configuration for a self-signed local cert.
• The suite must be given the HTTPS URL, and tls.insecure must stay unset — test_ssl.py:45 skips the certificate-validity check when tls.insecure = true, so setting it to swallow self-signed warnings would defeat the point. That means the CA needs to be trusted, not bypassed.

Open questions

• Self-signed with an explicitly trusted CA, or a real cert via a test domain? Self-signed plus trusted CA keeps it hermetic; the trade is that the trust plumbing has to work for both httpx and Playwright.
• Does this justify its own workflow, or a second job inside connect-smoke.yml? A separate job keeps the fast PR gate fast.
• Should the expiry assertion in test_ssl be given a deliberately short-lived cert so the check is proven to work, rather than trivially passing on a 10-year self-signed cert?

Acceptance

• test_https and test_ssl execute against a real TLS endpoint in CI, with certificate validation genuinely on.
• The run shows real passes, not skips — verified by confirming the tests fail when the proxy is misconfigured.

Start with connect-smoke.yml and the skip conditions in src/vip_tests/security/test_https.py and src/vip_tests/cross_product/test_ssl.py. Trace how the product URL and TLS settings reach httpx and Playwright, then run the affected suites against the proposed proxy setup. Done means both suites execute with certificate validation enabled, show real passes, and fail when the proxy is misconfigured.