http-api-client: T8955: leave warning handling to the callerfix/T8955-http-api-verify-tls

Address the round-2 adversarial-review finding: warnings.catch_warnings()
mutates the process-global filter list for the duration of the block (still
the case on Python 3.13), so scoping suppression inside the library was not
actually isolated.

- http_api_client no longer touches warning filters at all. The
  _suppress_insecure_warning helper is removed and post() calls
  session.post directly again. The unused warnings, contextmanager and
  urllib3 imports are dropped. The class docstring now states that callers
  disabling verification own InsecureRequestWarning handling. The OSError
  wrapping and verify_tls validation are unchanged.
- config_sync ignores InsecureRequestWarning in its __main__ block only,
  before opmode.run(). That one-shot op-mode process deliberately connects
  without verification (verify_tls=False) until T9396. Importing the module
  adds no filter.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 8 insertions, 0 deletions

diff --git a/src/op_mode/config_sync.py b/src/op_mode/config_sync.py
index fe8e69cab..35ed7320c 100644
--- a/src/op_mode/config_sync.py
+++ b/src/op_mode/config_sync.py
@@ -16,6 +16,8 @@
 
 import sys
 import typing
+import warnings
+import urllib3
 from pathlib import Path
 
 from vyos import opmode
@@ -293,6 +295,12 @@ def show_sync_diff(
 
 
 if __name__ == '__main__':
+    # This one-shot op-mode process deliberately connects to the secondary
+    # without TLS verification (verify_tls=False) until T9396. The filter is
+    # scoped to this process only; the library never touches warning filters.
+    warnings.filterwarnings(
+        'ignore', category=urllib3.exceptions.InsecureRequestWarning
+    )
     try:
         res = opmode.run(sys.modules[__name__])
         if res: