Today, Grype can access OCI registries, but only via HTTPS (with a few explicit exceptions made by the go-containerregistry library).

Request: Grype should allow a configuration option to let the user direct Grype to allow the HTTP scheme (as opposed to HTTPS) when communicating with the specified registry.