feat: add --chat-hook-allow-insecure to allow plain HTTP chat hook URLs (#27896)

Adds a hidden `--chat-hook-allow-insecure` /
`CODER_CHAT_HOOK_ALLOW_INSECURE` deployment option (default `false`)
that allows the chat lifecycle hook URL to use plain HTTP for any host.

The HTTPS requirement is enforced at two points, and the flag relaxes
both: `DeploymentValues.Validate()` rejects `http` hook URLs at startup,
and the hook dispatcher's `validateHookURL` allows `http` only for
loopback hosts. With the flag set, any-host `http` is accepted; the
host, fragment/userinfo, secret, and timeout checks are unchanged, and
non-http(s) schemes still fail. This removes the need for an HTTPS
reverse proxy when testing a hook consumer on a trusted network.

Following security review feedback, the flag description and docs state
that plain HTTP lets an on-path attacker forge hook responses (which
control agent execution), and `coder server` logs a startup warning
(with a redacted hook URL) when hooks run over plain HTTP.

Docs, generated API types, and the server config golden are updated
accordingly.

> Mux acted on Mike's behalf to create this PR.

cli/testdata/server-config.yaml.golden

@@ -803,8 +803,9 @@ chat:
   # opt-in settings.
   # (default: false, type: bool)
   debugLoggingEnabled: false
-  # HTTPS URL to receive chat agent lifecycle hook events. Hooks are disabled when
-  # unset. Requires the agent-lifecycle-hooks experiment.
+  # HTTPS URL to receive chat agent lifecycle hook events (plain HTTP requires
+  # --chat-hook-allow-insecure). Hooks are disabled when unset. Requires the
+  # agent-lifecycle-hooks experiment.
   # (default: <unset>, type: url)
   hookURL:
   # Maximum time to wait for a chat agent lifecycle hook response.
@@ -814,6 +815,11 @@ chat:
   # Requires the agent-lifecycle-hooks experiment.
   # (default: true, type: bool)
   hookEnabled: true
+  # Allow the chat hook URL to use plain HTTP for any host. Plain HTTP exposes
+  # sensitive chat data and lets an on-path attacker forge hook responses that
+  # control agent execution, so only enable this on a network you fully trust.
+  # (default: false, type: bool)
+  hookAllowInsecure: false
   # Deprecated: AI Gateway routing is now the only routing path. Setting this value
   # has no effect. This option will be removed in a future release.
   # (default: true, type: bool)