fix(kubernetes-nodes): hold factory-CA downloads to https redirects

With COZY_TALOS_FACTORY_CA set, curl -L still followed a redirect to plain
http, so the image could arrive without the TLS verification the CA was
given for. The CA path now passes --proto-redir =https, in line with the
refusal of a CA for an http factory. The no-CA program is unchanged.

Assisted-by: LLM
Signed-off-by: Marian Koreniuk <moriarti@cp.if.ua>

hack/proxmox-talos-template.sh

@@ -187,12 +187,14 @@ EOF
     # host still verifies: CDI appends talos.imageFactoryCA to its system pool
     # the same way. The blank line keeps a bundle without a final newline from
     # running into the first block. The terminator holds an underscore, which
-    # no line of a checked certificate block can.
+    # no line of a checked certificate block can. A CA is accepted only for an
+    # https factory, and redirects are held to https as well, so the image
+    # cannot leave TLS verification halfway.
     cat <<EOF
 { cat /etc/ssl/certs/ca-certificates.crt; echo; cat; } > "\$work/factory-ca.pem" <<'FACTORY_CA_PEM'
 $CA_PEM
 FACTORY_CA_PEM
-curl -fL --retry 3 --cacert "\$work/factory-ca.pem" -o "\$work/disk.raw.xz" "\$URL"
+curl -fL --retry 3 --proto-redir =https --cacert "\$work/factory-ca.pem" -o "\$work/disk.raw.xz" "\$URL"
 EOF
   fi
   cat <<'EOF'

hack/proxmox-talos-template_test.bats

@@ -128,7 +128,7 @@ EOF
     "$SCRIPT" print 9002 main-pool |
     sed "s|/etc/ssl/certs/ca-certificates.crt|$stub/system.pem|" |
     PATH="$stub:$PATH" TMPDIR="$stub" sh >/dev/null
-  grep -qE '^curl -fL --retry 3 --cacert [^ ]*/factory-ca.pem -o [^ ]*/disk.raw.xz https://factory.internal/' "$stub/calls"
+  grep -qE '^curl -fL --retry 3 --proto-redir =https --cacert [^ ]*/factory-ca.pem -o [^ ]*/disk.raw.xz https://factory.internal/' "$stub/calls"
   got="$(cat "$stub/cacert")"
   want="$(printf 'system bundle\n\n'; grep -v '^$' "$stub/ca.pem")"
   [ "$got" = "$want" ] || { printf 'curl was handed:\n%s\nexpected:\n%s\n' "$got" "$want" >&2; false; }