flightcheck: offline https link gate + run FlightCheck suite in CI

[daeunJe0ng]

Summary

Adds a deterministic, offline CI gate on FlightCheck report links, and wires the previously-unrun FlightCheck test suite into CI.

FlightCheck emits URLs into the HTML report (doc_link buttons and remediation deep-links). This PR adds one durable, offline-checkable guarantee about them: a URL an operator is meant to fetch uses https. It also makes the whole FlightCheck pytest suite run on every PR, which it did not before.

Reworked from the original host-allowlist approach. See "What changed vs. the first version" below.

What this does

• tests/flightcheck/url_hygiene_rules.py: the rule set. One fail-closed rule: every fetchable URL must be https, unless its host is a known namespace / identifier URI (SOAP / SAML namespaces) that is legitimately http. A small structural host-shape helper catches malformed captures.
• tests/flightcheck/test_url_hygiene.py: scans FlightCheck source (stdlib only, no imports of check modules, no network) for every http(s) URL and asserts each fetchable host uses https and looks like a real domain.
• .github/workflows/ci.yml: replaces the old single-file job with flightcheck-tests, which installs runtime + test deps and runs the entire offline FlightCheck suite (1003 tests). None of these tests ran in CI before, so this is where the real enforcement now lives.

What changed vs. the first version

The first version required every host appearing in FlightCheck source to be registered in a curated allowlist (url_registry.py). That was dropped because:

• Self-referential. The same author who writes a URL also edits the allowlist, so a typo copied into the allowlist passes. It only caught "typo the URL but forget the registry".
• High-maintenance and false-positive-prone. Every new legitimate host, including hosts that only appear in docstrings and never reach a report, was a red build until hand-registered. It flagged legitimate hosts like schema.management.azure.com (an ARM namespace URI) and www.microsoft.com (the Azure service-tags download page).
• The bug it targeted is rare and already covered by human review plus the repo's "No fabricated URLs" rule.

The fail-closed https rule keeps the one property worth enforcing offline, covers new hosts by default with no upkeep, and stops flagging legitimate hosts.

Scope and honest limits

• This gate checks link scheme (https) and basic host shape. It is offline and deterministic, so it is safe to gate every PR on.
• It does not make links clickable — the report renderer does that (flightcheck: autolink bare URLs in report remediation #208).
• It does not verify a path is live. A well-formed https://learn.microsoft.com/<moved-article> that now 404s or redirects to the docs home still passes. That "stale path" problem needs a live, networked checker, intentionally kept out of this deterministic suite.

Testing

• python -m pytest tests/flightcheck/test_url_hygiene.py -q -> 7 passed.
• python -m pytest tests/flightcheck -q (the full suite the CI job runs) -> 1003 passed.
• ruff check on both new files -> clean.
• ci.yml parses as valid YAML.

Relationship to #208

Complementary, not overlapping. #208 makes report URLs clickable; this PR makes sure a fetchable link uses https and runs the FlightCheck suite in CI.