Change the check with 200 OK for HTTP/2 200

See that we still getting the data as before: https://github.com/operator-framework/catalogd/actions/runs/12322347604/job/34395719725?pr=460

cmd/manager/main.go

@@ -165,15 +165,28 @@ func main() {
 		BindAddress: metricsAddr,
 	}
 
+	tlsOpts := func(config *tls.Config) {
+		config.GetCertificate = cw.GetCertificate
+
+		// If the enable-http2 flag is false (the default), http/2 should be disabled
+		// due to its vulnerabilities. More specifically, disabling http/2 will
+		// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
+		// Rapid Reset CVEs. For more information see:
+		// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
+		// - https://github.com/advisories/GHSA-4374-p667-p6c8
+		// Besides, those CVEs are solved already; the solution is still insufficient, and we need to mitigate
+		// the risks. More info https://github.com/golang/go/issues/63417
+		setupLog.Info("disabling http/2")
+		config.NextProtos = []string{"http/1.1"}
+	}
+
 	if metricsAddr == "0" {
 		setupLog.Info("metrics server disabled")
 	} else {
 		setupLog.Info("enabling metrics server", "address", metricsAddr)
 		metricsServerOptions.SecureServing = true
 		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
-		metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) {
-			config.GetCertificate = cw.GetCertificate
-		})
+		metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsOpts)
 	}
 
 	// Create webhook server and configure TLS

test/e2e/metrics_endpoint_test.go

@@ -87,5 +87,5 @@ func TestCatalogdMetricsExportedEndpoint(t *testing.T) {
 		"curl", "-v", "-k", "-H", "Authorization: Bearer "+token, metricsURL)
 	output, err = curlCmd.CombinedOutput()
 	require.NoError(t, err, "Error calling metrics endpoint: %s", string(output))
-	require.Contains(t, string(output), "200 OK", "Metrics endpoint did not return 200 OK")
+	require.Contains(t, string(output), "HTTP/2 200", "Metrics endpoint did not return HTTP/2 200")
 }