security: default HTTP client verify to True (secure)

Both the httpx and requests REST client plugins defaulted to
`verify=False`, silently disabling TLS verification for every HTTP
call in the framework. Test traffic to production-like endpoints
(security tests, API contract tests, LLM-judge calls) went over
unverified TLS, defeating the point of the security-tests suite.

Flip the default to True. Tests targeting self-signed endpoints must
opt out explicitly via `verify=False` or pass a CA bundle path. This
matches the same posture change just made in agentic-qa-agent for
vsphere_verify_ssl.

Tests: 9 httpx + restclient unit tests pass under the new default.

Author: WesleyPeng

src/main/python/taf/foundation/plugins/svc/httpx/httpclient.py

@@ -41,8 +41,10 @@ def __init__(
             **kwargs
     ):
         headers = kwargs.pop('headers', None)
-        # Caller may override TLS verification; preserve test-friendly default.
-        verify = kwargs.pop('verify', False)
+        # TLS verification defaults to True (secure). Tests targeting
+        # self-signed endpoints must opt out explicitly via verify=False
+        # or pass a CA bundle path.
+        verify = kwargs.pop('verify', True)
 
         super().__init__(
             base_url, port,

src/main/python/taf/foundation/plugins/svc/requests/restclient.py

@@ -44,8 +44,10 @@ def __init__(
     ):
         Session.__init__(self)
 
-        # Caller may override TLS verification; preserve test-friendly default.
-        verify = kwargs.pop('verify', False)
+        # TLS verification defaults to True (secure). Tests targeting
+        # self-signed endpoints must opt out explicitly via verify=False
+        # or pass a CA bundle path.
+        verify = kwargs.pop('verify', True)
 
         Client.__init__(
             self, base_url, port,