The http version being used by the metrics service is HTTP/2. More details seen from below.
% cat test/extended/testdata/securityandcompliance/spo/metrics-reader-cr.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: spod-metrics-reader
rules:
- nonResourceURLs:
 - "/metrics-spod"
 verbs:
 - get
% cat test/extended/testdata/securityandcompliance/spo/metrics-reader-crb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 name: spod-metrics-reader-default
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: spod-metrics-reader
subjects:
- kind: ServiceAccount
 name: default
 namespace: security-profiles-operator%                                                                                     
 % oc apply -f test/extended/testdata/securityandcompliance/spo/metrics-reader-cr.yaml 
clusterrole.rbac.authorization.k8s.io/spod-metrics-reader created
% oc apply -f test/extended/testdata/securityandcompliance/spo/metrics-reader-crb.yaml
clusterrolebinding.rbac.authorization.k8s.io/spod-metrics-reader-default created

 % url to be curled: https://metrics.security-profiles-operator/metrics-spod

Seen from the description

The http version being used by the metrics service is httpv2

The http version being used by the metrics service should be http v1.1

https://github.com/kubernetes-sigs/security-profiles-operator/pull/1923