Fixes #30122 - remove usage of controller level force_ssl

Foreman's use case for HTTP-only is provisioning. Many installers, like Red
Hat's Anaconda or Debian Preseed, either do not support it or make it very hard
to use HTTPS. This is especially hard since often a custom CA is used so the
establishing the trust chain is hard.

Rails 6.1 drops support for controller level force_ssl. This implements our
use-case as options for the ssl middleware. Our use-case is valid, but it is
better to rely on supported features and not to pull a 3rd party gem.

This does not implement a mechanism for plugins to run HTTP-only. This is
because designing a good API proved to be hard and we didn't see a scenario
where it would be needed.