volume: avoid read-only replica write targets (#11195)

* master: carry replica read-only state in volume lookups

* volume: refresh writable replica targets

* volume: preserve read-only replicas for deletes

* master: propagate read-only delete capability

* volume: target delete-capable replicas

* volume: honor configured HTTPS for replica deletes

* volume: reject insecure delete authorization forwarding

* master: broadcast delete capability changes

* volume: align Rust replica routing

* http: protect credentialed replica redirects

* master: preserve digest compatibility for delete capability

* volume: propagate read-only state in short heartbeats

* volume: report changed short volume state

* http: guard TLS client redirects

* master: announce mounted volume read-only state

* volume: replace changed identity deltas

* master: replace incremental volume layouts in order

* master: keep moved volume lookup available

* volume: announce read-only mounts

weed/util/http/client/http_client.go

@@ -110,6 +110,20 @@ func (httpClient *HTTPClient) GetHttpScheme() string {
 	return "http"
 }
 
+func (httpClient *HTTPClient) IsTLSVerified() bool {
+	return httpClient.expectHttpsScheme && httpClient.Transport != nil && (httpClient.Transport.TLSClientConfig == nil || !httpClient.Transport.TLSClientConfig.InsecureSkipVerify)
+}
+
+func rejectHttpsDowngrade(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return http.ErrUseLastResponse
+	}
+	if len(via) > 0 && via[0].URL.Scheme == "https" && req.URL.Scheme != "https" {
+		return http.ErrUseLastResponse
+	}
+	return nil
+}
+
 func (httpClient *HTTPClient) NormalizeHttpScheme(rawURL string) (string, error) {
 	expectedScheme := httpClient.GetHttpScheme()
 
@@ -183,7 +197,8 @@ func NewHttpClient(clientName ClientName, opts ...HttpClientOpt) (*HTTPClient, e
 		IdleConnTimeout:       idleConnTimeout,
 	}
 	httpClient.Client = &http.Client{
-		Transport: httpClient.Transport,
+		Transport:     httpClient.Transport,
+		CheckRedirect: rejectHttpsDowngrade,
 	}
 
 	for _, opt := range opts {
@@ -301,7 +316,8 @@ func NewHttpClientWithTLS(certFile, keyFile, caFile string, insecureSkipVerify b
 		IdleConnTimeout:       idleConnTimeout,
 	}
 	httpClient.Client = &http.Client{
-		Transport: httpClient.Transport,
+		Transport:     httpClient.Transport,
+		CheckRedirect: rejectHttpsDowngrade,
 	}
 
 	for _, opt := range opts {