[Bug] Automatic Swagger document loading downgrades HTTPS upstreams to HTTP #7894

Bug description

Automatic Swagger/OpenAPI document loading in Admin loses the upstream HTTP scheme. On current master (9f57e930169404dd2d2e50b838bd651a18833924), a discovery upstream with protocol=https:// and url=example.com:8443 produces a request to http://example.com:8443/<context>/v3/api-docs. Without an explicit port it also defaults to 80 instead of 443.

This affects both the initial scan (loadApiDocument) and discovery CREATE/UPDATE callbacks (loadDocOnUpstreamChanged). An HTTPS-only backend therefore fails automatic document loading even when its discovery configuration is correct.

Reproduction and evidence

1. Enable the Admin API document loading dictionary flag.
2. Configure a divide upstream with protocol=https://, url=example.com:8443 and selector name /project.
3. Trigger the initial scan or an upstream UPDATE event.
4. Observe an HTTP request to http://example.com:8443/project/v3/api-docs, rather than HTTPS.

A local regression test invokes the public loader entry points, runs the real PullSwaggerDocServiceImpl and HttpUtils request-building path, and records the outgoing OkHttp request with an application interceptor. Both entry points currently send HTTP for HTTPS inputs. The HTTP/default-protocol control cases pass. No external endpoint is contacted by this test.

Cause and proposed scope

• Both upstream conversion paths in LoadServiceDocEntryImpl split the address on : and default missing ports to 80, discarding DiscoveryUpstreamData.protocol.
• UpstreamInstance has no scheme field.
• PullSwaggerDocServiceImpl.getSwaggerRequestUrl hard-codes http.

Preserve the upstream scheme through the internal instance object, retain HTTP as the default for existing callers, select 443 for HTTPS without an explicit port, and use the preserved scheme to construct the document request. Carry the same scheme into generated API document metadata so debug requests do not revert to HTTP. Use URI parsing locally for the document-loader conversion.

Related work / boundaries

This is the automatic upstream-document loading path. It is distinct from manual Swagger URL import and its port/DNS policy (#7595, PR #7868), and is not established as the cause of #6362. PR #6456 also touches address parsing in LoadServiceDocEntryImpl for general IPv6 support; the document-loader URI parsing will need reconciliation if both changes land. This issue does not propose changes to gateway routing, TLS certificate validation or general discovery address normalization.

I am preparing a focused fix and regression coverage.