http_proxy: Add upstream proxy configuration

Second of the stack. Adds `UpstreamProxy`: parsing of an upstream HTTP
proxy from the environment (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` and
lowercase forms) with `NO_PROXY` bypass matching delegated to the
`proxyvars` crate, basic-auth credentials (kept out of `Debug`/`Display`),
and IPv6/default-port normalization. Used by the proxy server in the next
PR to chain outbound connections through a corporate proxy when one is
configured.

Release Notes:

- N/A

Author: rtfeldman

Cargo.lock

@@ -697,6 +697,7 @@ profiling = "1"
 # replace this with main when #635 is merged
 proptest = { git = "https://github.com/proptest-rs/proptest", rev = "3dca198a8fef1b32e3a66f1e1897c955b4dc5b5b", features = ["attr-macro"] }
 proptest-derive = "0.8.0"
+proxyvars = "0.2"
 prost = "0.9"
 prost-build = "0.9"
 prost-types = "0.9"

Cargo.toml

@@ -12,5 +12,9 @@ workspace = true
 path = "src/http_proxy.rs"
 
 [dependencies]
+anyhow.workspace = true
 idna.workspace = true
+percent-encoding.workspace = true
+proxyvars.workspace = true
 thiserror.workspace = true
+url.workspace = true

crates/http_proxy/Cargo.toml

@@ -4,11 +4,14 @@
 //!
 //! - [`allowlist`]: the policy types ([`HostPattern`], [`Allowlist`]) that
 //!   decide which hosts a sandboxed command may reach.
-//! - `upstream` (next): parsing an upstream HTTP proxy from the environment.
-//! - the proxy server itself (last): an in-process HTTP/HTTPS proxy that
+//! - [`UpstreamProxy`]: parsing an upstream HTTP proxy from the environment
+//!   (`HTTPS_PROXY` / `NO_PROXY` etc.) to chain through.
+//! - the proxy server itself (next): an in-process HTTP/HTTPS proxy that
 //!   enforces an [`Allowlist`] and is the only network egress a sandboxed
 //!   command is permitted.
 
 mod allowlist;
+mod proxy;
 
 pub use allowlist::{Allowlist, HostPattern, HostPatternError};
+pub use proxy::UpstreamProxy;

crates/http_proxy/src/http_proxy.rs

@@ -0,0 +1,7 @@
+//! The proxy module. For now it holds only the upstream-proxy configuration
+//! type; the proxy server (listener, connection handling) lands in a later
+//! PR.
+
+mod upstream;
+
+pub use upstream::UpstreamProxy;