Suppose one hosts a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.), without using HTTPS. What potential security issues arise as a direct consequence from this? Assume that man-in-the-middle attacks are useless, as there is no valuable data to extract from an attackers perspective.
... a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.)
Sensitive data might be way more than passwords or session cookies. These might involve the specific URL, the content of the returned information etc. Just imagine users browsing sites with information to specific health conditions or sexual preferences - it is sensitive what the user is visiting even if no passwords or sessions are involved. Without HTTPS the ISP or some attacker in the path (like a parent in the local network) can view this kind of traffic.
Apart from that without HTTPS the integrity of the data isn't protected either, i.e. some man in the middle might modify existing content or serve its own content. This might be used to serve wrong information or block specific information. But it might also be used to run attacks against the user, as was done in this recent case in Egypt.
HTTPS provides integrity for request and response data (headers and body). If the connection isn't secure, then someone may be able to hijack the connection, and inject unwanted info onto the pages you're browsing. This can make the owner of the website lose reputation if the injected data are harmful contents.
However plaintext HTTP does find some use in operating system updates - Debian use plaintext HTTP (assuming for efficiency reasons) and verify package integrity using digital signatures with public-key embedded into the operating system.
Another point is that, increasingly many Web APIs now require a "secure context" to operate. You can get it using loopback address when testing your website locally, but you need an HTTPS connection when you go online.