You're right with ISPs. These days they'd only be able to see the domain name. That part of the HTTP header is unencrypted. Man-in-the-middle won't work, as you said, due to certificate pinning.