Fix SSRF protection bypass in common-third-parties-import

The HTTP transport was replaced after WithSSRFProtection() was applied,
discarding the protected dialer. Wrap the existing transport with
userAgentTransport instead of replacing it.

Signed-off-by: Émile Ré <emile@getprobo.com>

cmd/common-third-parties-import/main.go

@@ -25,7 +25,6 @@ package main
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"flag"
 	"fmt"
@@ -234,27 +233,10 @@ func fetchAndStoreLogos(
 ) error {
 	s3Client := newS3Client(endpoint, region, accessKey, secretKey, usePathStyle)
 	fileMgr := filemanager.NewService(s3Client)
-	tlsConfig := &tls.Config{
-		CipherSuites: []uint16{
-			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_AES_128_GCM_SHA256,
-			tls.VersionTLS13,
-			tls.VersionTLS10,
-		},
-	}
 	httpClient := httpclient.DefaultPooledClient(httpclient.WithSSRFProtection())
 	httpClient.Transport = &userAgentTransport{
-		next: &http.Transport{
+		next: httpClient.Transport,
-			TLSHandshakeTimeout: 30 * time.Second,
+		ua:   version.UserAgent("common-third-parties-import"),
-			DisableKeepAlives:   false,
-			TLSClientConfig:     tlsConfig,
-			DialTLS: func(network, addr string) (net.Conn, error) {
-				return tls.Dial(network, addr, tlsConfig)
-			},
-		},
-		ua: version.UserAgent("common-third-parties-import"),
 	}
 	scope := coredata.NewScope(gid.NilTenant)