Make transport-security requirements protocol-neutral

[jeremi]

Problem

govstack-cfr-security#req-1 currently requires all communication to use HTTPS with TLS 1.3 or higher.

That wording is appropriate for HTTP, but it conflicts with the protocol-neutral architecture model:

• govstack-cfr-architecture#req-2 explicitly permits HTTP, Publish/Subscribe, gRPC, or a custom protocol.
• govstack-cfr-architecture#req-19 requires published asynchronous interface schemas.
• AsyncAPI can describe MQTT, AMQP, Kafka, WebSockets, and other transports that are not all expressed as HTTPS URLs.

The security outcome should remain mandatory and immutable. The mechanism should not imply that every valid GovStack interface is HTTP.

Proposed change

Rewrite the requirement around protected transport:

• HTTP endpoints and HTTP callbacks use HTTPS with TLS 1.3 or higher.
• Protocols with a TLS binding use TLS 1.3 or higher.
• A protocol that does not use TLS must declare a standardized security binding that provides equivalent confidentiality, integrity, and peer or server authentication.
• Plaintext transport must not carry credentials, personal data, or GovStack domain messages outside isolated local development.
• Protocol-specific certificate trust, cipher, and deployment configuration remain in the relevant security or operations profile.

Suggested direction:

All communication between Building Blocks and external clients uses a protected transport that provides confidentiality, integrity, and peer authentication. HTTP interfaces use HTTPS. Protocols with a TLS binding use TLS 1.3 or higher. Other protocols use a documented standardized security binding that provides equivalent protection. Plaintext production interfaces are not permitted.

Acceptance criteria

• govstack-cfr-security#req-1 states a protocol-neutral security outcome.
• HTTPS remains mandatory for HTTP interfaces.
• TLS 1.3 or higher remains mandatory wherever TLS is used.
• Async and non-HTTP interfaces are covered without being mislabeled as HTTPS.
• The wording is consistent with govstack-cfr-architecture#req-2 and #req-19.
• The requirement remains REQUIRED, IMMUTABLE, and externally verifiable.