OTLP exporters have improper default endpoint

[pellared]

Got

The OTLP default endpoints default to https (secure) scheme.

Want

The OTLP default endpoints default to http (insecure) scheme.

Per: https://github.com/open-telemetry/opentelemetry-specification/blob/v1.21.0/specification/protocol/exporter.md

[pellared]

To begin with, we need to consider the implications of changing the OTLP exporter. Such a modification would fundamentally alter the default behavior, possibly causing disruptions in the existing setup.

One significant concern is that changing the default would break most code that is using secure HTTPS endpoints. Presently, the otlptracehttp lacks a WithSecure method, offering only an option for insecure connections. Moreover WithEndpoint does not accept the scheme (it only accepts the hostname). Altering the default behavior might lead to unintended consequences for users relying on secure HTTPS. While changing the default could be convenient for users employing otlptracegrpc.WithTLSCredentials(insecure.NewCredentials()) for gRPC and otlptracehttp.WithInsecure for HTTP, it would result in a lack of backward compatibility.

Introducing a new factory functions with different defaults, that would be compliant with the specification, might introduce unnecessary confusion and expand the complexity of the API.

Therefore, maintaining the current approach appears to be the most viable option. Instead, we might consider clearly documenting the default behavior and acknowledging our deviation from the specification in this aspect.

At last from https://github.com/open-telemetry/opentelemetry-specification/blob/v1.21.0/specification/protocol/exporter.md?plain=1#L52-L53

[1]: SDKs SHOULD default endpoint variables to use http scheme unless they have good reasons to choose https scheme for the default (e.g., for backward compatibility reasons in a stable SDK release).

[pellared]

I plan to close it by end of this week.

CC @open-telemetry/go-approvers

[pellared]

SIG meeting:
We should make sure that we are clearly documenting that we are defaulting to HTTPS/secure gRPC.

[pellared]

I created #4688 for documentation cleanup.