[management,client] Default to NetBird's upload service when nothing is configured

The previous commit made a peer with no destination — no MDM override, no URL
named by the caller, nothing published by its management server — refuse to
upload and keep the bundle local unless it was enrolled with NetBird's cloud.
That closed the reported data-boundary concern, but it broke the default for
everyone who uploads a bundle as part of their day: a self-hosted user opening
a support ticket got a refusal where the command used to work.

Product decision (NetBird's, not the reporter's): the knob to keep bundles
inside your own infrastructure is what this branch provides, and it is enough.
The default stays the service NetBird runs, self-hosted included. An admin who
needs the bundles to stay in-house configures the destination; until then the
everyday flow keeps working.

So ResolveUploadURL drops the cloud check, the sentinel error and the
managementURL argument, and never fails:

    MDM  >  explicitly named URL  >  published by management  >  NetBird's service

Nothing observable changes for a deployment that configures nothing, which also
removes two edge cases the fail-closed default had: a peer still enrolled on the
legacy api.wiretrustee.com host would have been classified self-hosted and
refused, and an upgrade would have silently stopped uploads for self-hosted
deployments relying on them. The privilege gate is unaffected — a host other
than the default one still requires a privileged caller, so pointing the CLI
somewhere other than what management published needs root.

client/internal/debug/destination_test.go

@@ -4,83 +4,50 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
 func TestResolveUploadURL(t *testing.T) {
 	const (
-		cloudMgm      = "https://api.netbird.io:443"
-		selfHostedMgm = "https://netbird.example.com:33073"
-		operatorURL   = "https://upload.example.com/upload-url"
-		requestedURL  = "https://requested.example.com/upload-url"
+		operatorURL  = "https://upload.example.com/upload-url"
+		requestedURL = "https://requested.example.com/upload-url"
 	)
 
 	tests := []struct {
-		name          string
-		requested     string
-		published     string
-		managementURL string
-		want          string
-		wantErr       bool
+		name      string
+		requested string
+		published string
+		want      string
 	}{
 		{
-			name:          "requested wins over published",
-			requested:     requestedURL,
-			published:     operatorURL,
-			managementURL: selfHostedMgm,
-			want:          requestedURL,
+			name:      "requested wins over published",
+			requested: requestedURL,
+			published: operatorURL,
+			want:      requestedURL,
 		},
 		{
-			name:          "requested wins on cloud too",
-			requested:     requestedURL,
-			managementURL: cloudMgm,
-			want:          requestedURL,
+			name:      "requested wins with nothing published",
+			requested: requestedURL,
+			want:      requestedURL,
 		},
 		{
-			name:          "published used when nothing requested",
-			published:     operatorURL,
-			managementURL: selfHostedMgm,
-			want:          operatorURL,
+			name:      "published used when nothing requested",
+			published: operatorURL,
+			want:      operatorURL,
 		},
 		{
-			// A cloud deployment publishing its own destination must not be
-			// overridden by the compiled-in default.
-			name:          "published wins over the cloud fallback",
-			published:     operatorURL,
-			managementURL: cloudMgm,
-			want:          operatorURL,
-		},
-		{
-			name:          "cloud falls back to the NetBird service",
-			managementURL: cloudMgm,
-			want:          types.DefaultBundleURL,
-		},
-		{
-			// The whole point of GHSA-hf99-43rj-h577: no silent hop to a
-			// vendor-controlled destination.
-			name:          "self-hosted with no destination fails closed",
-			managementURL: selfHostedMgm,
-			wantErr:       true,
-		},
-		{
-			name:          "unknown management URL fails closed",
-			managementURL: "",
-			wantErr:       true,
+			// The default stays the service NetBird runs whatever the
+			// deployment: an operator who wants the bundles elsewhere says so,
+			// and until then collecting one and sending it to support works.
+			name: "nothing configured falls back to the NetBird service",
+			want: types.DefaultBundleURL,
 		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			got, err := ResolveUploadURL(tc.requested, tc.published, tc.managementURL)
-			if tc.wantErr {
-				require.ErrorIs(t, err, ErrNoUploadDestination)
-				assert.Empty(t, got)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tc.want, got)
+			assert.Equal(t, tc.want, ResolveUploadURL(tc.requested, tc.published))
 		})
 	}
 }