feat: serve gRPC workloads with --http2 option

[savme]

A workload published with --http-port is always reached over HTTP/1.1, so a gRPC server behind a compute URL can't be called. This adds --http2 to compute deploy, which marks the URL's backend port as HTTP/2 (h2c) through the NetworkService appProtocol field added in datum-cloud/network-services-operator#653.

Like --http-port, the setting carries forward: later deploys keep it until --http2=false, reading it back from the URL because the workload spec has no field for it. If that read fails, the deploy stops instead of quietly switching to HTTP/1.1. The plan summary and workloads describe both show when a port is HTTP/2, and --http2 is refused with --no-http, with -f, or on a workload with no HTTP port.

Test plan

• Unit tests cover carry-forward, flag conflicts, the plan line, the backend appProtocol, switching on and off across redeploys, and the describe line
• On staging, a gRPC call through the edge reached a workload once its port was marked h2c (client ALPN enforcement off, see above)

Fixes #490