When you run ionic cap run android -l for debugging, usesCleartextTraffic gets auto added to the manifest.
For production, you should be using wss.
But, the capacitor.config.ts has an option under server.cleartext for debugging purposes too. See the notes about it here - Capacitor Configuration | Capacitor Documentation cap run mentioned above actually adds this temporarily which in turn configures the manifest.
You can also set cleartext for specific hosts. See Unable to carryout HTTP post on Android - #2 by twestrick