Allow HTTP for localhost in CSV-031 validation

[a6b8]

Problem

CSV-031 requires HTTPS for supported_interfaces[].url, but this blocks the entire A2A pipeline on localhost (HTTP), causing hasValidStructure: false and empty entries.

Fix

Allow HTTP when hostname is localhost or 127.0.0.1, matching OAuth/RFC behavior.