Disable HTTP/2 for webhook

[khrm]

We need to disable HTTP/2 for webhooks.

"
The go runtime does have a fix to mitigate the CVE-2023-44487 to a degree, but as kubernetes/kubernetes#121197 shows, a single connection attempting to perform a denial-of-service attack against a go-based HTTP/2 server resulted in the server process quickly consuming 5 GB of memory. Additional connections would likely result in an OOM situation very quickly.
"
Please check this: kubernetes/kubernetes#121197

/kind security

[vdemeester]

@tektoncd/core-maintainers what do we do around GHSA-qppj-fm5r-hxr3 ? As linked by @khrm in kubernetes/kubernetes#121197 most project seems to disable HTTP/2 server for webhooks (or "force HTTP 1.1" which is the same for now 😛 ) to make sure they are not exposed to this.

[dibyom]

Disabling HTTP2 sounds fine though do we know to what extent do we think our webhooks are impacted? Our webhooks are internal only right i.e. its the API server that is sending requests vs an untrusted user. So, ensuring the API server has mitigated this attack is critical

[dibyom]

@khrm @vdemeester is this still a critical/urgent?

[dibyom]

From @khrm - this fix comes from knative, we should update our dependency when it is fixed

[khrm]

/assign @khrm