OCP: support serving bundles directly

[srenatus]

Add http_server as a new object_storage variant for bundles, allowing OCP to serve bundles directly via its HTTP API without requiring external object storage

TODOs

• introduce new permission+role
• add actual e2e test with OPA

Note that

1. Bundles are held in memory and served on OCP's main HTTP server at the configured path, with full authentication and authorization (bearer token + bundles.download permission)
2. Supports the OPA bundle protocol: Content-Type: application/gzip, ETag-based caching with If-None-Match/304, and returns an X-OPA-Revision header

Example configuration

  bundles:
    hello-world:
      object_storage:
        http_server:
          path: bundles/hello-world/bundle.tar.gz # => /v1/external/bundles/hello-world/bundle.tar.gz
      requirements:
      - source: hello-world

When to use this

This is intended for development, testing, and simple deployments where running external object storage (S3, GCS, Azure Blob) is unnecessary overhead.
For production environments, an external object store like S3 is strongly recommended — it provides durability, scalability, and avoids coupling bundle availability to the OCP process lifecycle.
Bundles stored via http_server live only in memory and are lost when OCP restarts.