fix(cira): require opt-in for non-forward-secret ciphers

[nbmaiti]

Summary

Gate legacy RSA TLS cipher suites for the CIRA listener behind APP_ALLOW_INSECURE_CIPHERS.
Keep Go's secure TLS defaults enabled unless an operator explicitly opts in for older AMT compatibility.
Warn at startup when insecure cipher support is enabled.
Document the setting in the sample environment and configuration files.

Breaking Change

Deployments that require legacy RSA cipher suites must set:

APP_ALLOW_INSECURE_CIPHERS=true

Testing

Added coverage verifying insecure suites are excluded by default, included only with explicit opt-in, and recognized by Go as insecure.

[codecov]

Codecov Report

❌ Patch coverage is 55.55556% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.15%. Comparing base (2296f65) to head (77cb650).

Files with missing lines	Patch %	Lines
internal/controller/tcp/cira/tunnel.go	58.82%	7 Missing ⚠️
internal/app/app.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1200      +/-   ##
==========================================
+ Coverage   50.09%   50.15%   +0.06%     
==========================================
  Files         146      146              
  Lines       13552    13555       +3     
==========================================
+ Hits         6789     6799      +10     
+ Misses       6171     6164       -7     
  Partials      592      592              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens the CIRA TLS configuration by making legacy RSA key-exchange cipher suites (non-forward-secret) opt-in via APP_ALLOW_INSECURE_CIPHERS, aligning the listener with Go’s secure defaults unless explicitly overridden for older AMT compatibility.

Changes:

• Adds an allowInsecureCiphers toggle to the CIRA server and uses it to control whether legacy RSA cipher suites are advertised.
• Introduces focused unit tests to verify insecure suites are excluded by default and included only when explicitly enabled.
• Documents the setting in config/config.yml and .env.example.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/controller/tcp/cira/tunnel.go	Adds opt-in gating + warning behavior for legacy RSA cipher suites on the CIRA listener.
internal/controller/tcp/cira/tunnel_test.go	Adds tests covering default vs opt-in cipher suite behavior and Go’s insecure classification.
internal/app/app.go	Wires cfg.AllowInsecureCiphers into the CIRA server constructor.
config/config.yml	Documents allow_insecure_ciphers behavior and intended usage.
.env.example	Documents APP_ALLOW_INSECURE_CIPHERS and provides a sample value.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

internal/controller/tcp/cira/tunnel.go:103

• The warning message only references the env var, but this setting can also be enabled via config.yml (allow_insecure_ciphers). Mentioning both makes the startup warning actionable for operators using file-based config.

	s.log.Warn("CIRA server - insecure cipher suites enabled for AMT compatibility; " +
		"these lack perfect forward secrecy. Disable APP_ALLOW_INSECURE_CIPHERS unless required.")