fix: add x-forwarded-proto header to internal whoami httpCall

Envoy automatically appends x-forwarded-for to all outgoing requests,
including Lua httpCall subrequests. Synapse treats any request carrying
x-forwarded-for as a forwarded client request and warns when
x-forwarded-proto is absent, falling back to https assumption.

The whoami lookup is an internal Envoy subrequest, not a proxied client
request, so ideally it would carry neither forwarded header. However,
x-forwarded-for cannot be suppressed from a Lua httpCall — Envoy adds it
unconditionally. Overwriting x-forwarded-for with 127.0.0.1 would be
semantically cleaner but would discard potentially useful origin info if
Synapse ever uses it beyond this check.

Adding x-forwarded-proto: https is the minimal fix: it completes the
forwarded header pair, silences the warning, and keeps the request
headers consistent without masking the original IP.

Author: asp24

charts/synapse/scripts/synapse.lua

@@ -167,7 +167,8 @@ local function lookup_whoami(request_handle, token, options)
                 [":method"] = "GET",
                 [":path"] = get_option(options, "whoami_path", "/_matrix/client/v3/account/whoami"),
                 [":authority"] = authority,
-                ["authorization"] = "Bearer " .. token
+                ["authorization"] = "Bearer " .. token,
+                ["x-forwarded-proto"] = "https"
             },
             "",
             get_option(options, "timeout_ms", 5000)