🛡️ Sentinel: [HIGH] Fix InsecureSkipVerify in Management Handlers

[rschumann]

🚨 Severity: HIGH
💡 Vulnerability: The management handlers for discovering models (discover_models.go) and testing cloud providers (test_provider.go) were explicitly setting InsecureSkipVerify: true in the HTTP client Transport whenever a proxy URL was configured.
🎯 Impact: This allowed for Man-in-the-Middle (MITM) attacks where an attacker could intercept, read, and manipulate traffic between the switchAILocal gateway and external AI providers or proxies. Because this gateway routes sensitive API keys, authentication tokens, and user prompts, this posed a significant security risk.
🔧 Fix: Unconditionally removed the insecure TLSClientConfig override from the HTTP transports to enforce strict, standard TLS certificate validation. Cleaned up the now-unused "crypto/tls" imports in both files to ensure the application compiles.
✅ Verification: Verified by running env GOTOOLCHAIN=auto go test ./... -short (tests pass) and running gosec to confirm the G402 (CWE-295) vulnerability is fully mitigated.

(Added learning entry to Sentinel journal regarding TLS validation defaults).

---

PR created automatically by Jules for task 3963384084145974 started by @rschumann

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.