Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@python/packages/jumpstarter-cli/jumpstarter_cli/login.py`:
- Around line 30-33: The code currently only adds a scheme when missing, which
allows an explicit "http://" login_endpoint to bypass the insecure flag; update
the logic in the login function (where login_endpoint and insecure are handled)
to first check for an explicit "http://" prefix and, if present and insecure is
False, fail/require confirmation (i.e., raise or surface the same
warning/confirmation path), otherwise proceed; only if no scheme is present
(login_endpoint does not start with "http://" or "https://") should you
normalize by prepending scheme = "http" if insecure else "https". Ensure you
reference and enforce the insecure flag when
login_endpoint.startswith("http://") so explicit HTTP endpoints cannot bypass
the gate.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@python/packages/jumpstarter-cli/jumpstarter_cli/login_test.py`:
- Around line 13-17: The test test_fetch_auth_config_allows_http_with_insecure
currently relies on a real network failure; instead, patch
aiohttp.ClientSession.get (or use a local async test server) to make the test
deterministic: mock ClientSession.get to capture the requested URL and ensure it
is called with "http://login.example.com" when invoking
fetch_auth_config("http://login.example.com", insecure=True), then either return
a controlled mock response or raise a specific, expected exception and assert
the call occurred; update the assertion to verify the mocked call was made and
that insecure=True path in fetch_auth_config was exercised rather than catching
any Exception.

In `@python/packages/jumpstarter-cli/jumpstarter_cli/login.py`:
- Line 120: The current confirm_insecure(insecure, nointeractive) call
under-warns the case where a scheme-less login_target will fall back to plain
HTTP; update the login flow so the user sees an explicit HTTP fallback warning:
after parsing login_target into its endpoint (the code that resolves/normalizes
the target), either (A) call a new login-specific prompt (e.g.,
confirm_insecure_login(...)) that mentions "TLS disabled and will use plain HTTP
for this endpoint" or (B) extend confirm_insecure to accept a parameter like
will_use_http (or parsed_endpoint) and include the HTTP-specific text when true;
adjust the call site in login.py to pass the parsed endpoint/flag and ensure
nointeractive behavior is preserved.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@python/packages/jumpstarter-cli-common/jumpstarter_cli_common/opt.py`:
- Around line 102-105: Update the confirmation prompt in confirm_insecure to
reflect the broader "insecure mode" semantics (not just TLS verification) by
changing the message passed to click.confirm to mention that insecure mode may
disable TLS verification and allow plain HTTP; keep the same conditional flow
and abort behavior in the confirm_insecure function so the prompt text (in
confirm_insecure) is the only change.