fix(stdiscosrv): only read certificate proxy headers with --http (#10674)

These headers should not be inspected when running with a TLS listener.

Additionally, we should really enable them individually instead of
trusting the proxy to filter out the unused variants, but baby steps.

Reported by multiple AI vuln scanners.

Signed-off-by: Jakob Borg <jakob@kastelo.net>

cmd/stdiscosrv/apisrv.go

@@ -254,7 +254,7 @@ func (s *apiSrv) handleGET(w http.ResponseWriter, req *http.Request) {
 func (s *apiSrv) handlePOST(remoteAddr *net.TCPAddr, w http.ResponseWriter, req *http.Request) {
 	reqID := req.Context().Value(idKey).(requestID)
 
-	rawCert, err := certificateBytes(req)
+	rawCert, err := s.certificateBytes(req)
 	if err != nil {
 		slog.Debug("Request without certificates", "id", reqID, "error", err)
 		announceRequestsTotal.WithLabelValues("no_certificate").Inc()
@@ -330,10 +330,13 @@ func handlePing(w http.ResponseWriter, _ *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
-func certificateBytes(req *http.Request) ([]byte, error) {
+func (s *apiSrv) certificateBytes(req *http.Request) ([]byte, error) {
 	if req.TLS != nil && len(req.TLS.PeerCertificates) > 0 {
 		return req.TLS.PeerCertificates[0].Raw, nil
 	}
+	if !s.useHTTP {
+		return nil, errors.New("no certificate presented")
+	}
 
 	var bs []byte