Multisite signup and activation flow generates incorrect HTTP URLs when SSL is enabled

[meet_hasmukh]

Steps to Reproduce

1. Set up a WordPress Multisite network.
2. Navigate to Network Admin → Settings → Network Settings (wp-admin/network/settings.php).
3. Under Registration Settings, select Both sites and user accounts can be registered for Allow new registrations.
4. Visit wp-signup.php.
5. Complete the signup form and check "Gimme a site!" before submitting.
6. Submit the form.
7. After submission, observe that the confirmation page redirects back to wp-signup.php.
8. Notice that the newly created site URL displayed on the confirmation page uses the http protocol instead of https, even though SSL is enabled for the network.
9. Retrieve the activation email and open the activation URL, for example: wp-activate.php?key=bf14799fcf14ecc1
10. Complete the activation process.
11. Open the same activation URL again after the account has already been activated.
12. Observe the network link displayed on the page.

Expected Behavior

• All generated URLs should use the correct https protocol when SSL is enabled.
• The site URL shown on the signup confirmation page should use https.
• The network link shown when revisiting an already-used activation link should be valid and use https.
• URLs should not contain duplicated protocol prefixes.

Actual Behavior

• The site URL displayed on the signup confirmation page uses http instead of https.
• Revisiting an already-used activation link displays a network URL that uses http.
• The generated URL contains the protocol twice (for example, http://http://example.com), resulting in a broken link.

Environment Details

• WordPress Version: 7.0
• Multisite: Enabled
• Registration Mode: "Both sites and user accounts can be registered"
• PHP Version: 8.3.23
• Web Server: Nginx
• SSL: Enabled
• Browser: Any

Notes

The issue appears to affect URL generation in the Multisite signup and activation flow when SSL is enabled. The generated links do not consistently honor the network's HTTPS configuration and may produce malformed URLs when an activation link is revisited after successful activation.

[meet_hasmukh]

The signup confirmation page showing an http site URL instead of https.

[meet_hasmukh]

The page displayed when revisiting the activation link, showing the malformed network URL with duplicated protocols (​http://http://...).

Trac ticket: https://core.trac.wordpress.org/ticket/65506

[meet_hasmukh]

​https://github.com/WordPress/wordpress-develop/pull/12257

[westonruter]

Related: #65521

[westonruter]

In 62651:

Login and Registration: Fix signup and activation URL schemes.

When an already-active signup is revisited, wp-activate.php hard-coded the http:// scheme and passed the scheme-less domain and path through esc_url(), which prepended its own http:// and produced a doubled, broken http://http:// link. Build the full URL with the correct scheme from is_ssl() before escaping it.

Additionally, the signup confirmation heading in wp-signup.php now uses a scheme-relative // URL so the link honors the network's HTTPS configuration instead of forcing http.

This also hardens related code in wp-activate.php and wpmu_activate_signup() against type issues surfaced by PHPStan, including normalizing the signup meta to always be an array.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12257.
Follow-up to r12603, r48672, r57625.

Props meet_hasmukh, westonruter.
See #64898.
Fixes #65506.