I would probably add TLS in thereas an optional layer between TCP and HTTP. But http/3 and quic complicates things because it kind of blends the tcp, tls, and http layers together.
IMHO that's the highest layer of the OSI model that is useful. After that it's various ways of tunnelling streams inside of streams.