test(supervisor-network): add proxy hostname parser regression tests

[shaneutt]

Summary

Add regression coverage for parser differentials in the egress proxy's CONNECT hostname handling and OPA wildcard policy matching.

Related Issue

Resolves #1498

Changes

• parse_target: 18 tests documenting behavior with NUL bytes, control chars, percent-encoded characters, empty hosts, oversized names, bracket chars, slashes, backslashes, port boundaries, and IPv6
• parse_proxy_uri: 4 tests for the same malformed-input classes in the forward proxy URI parser
• OPA wildcard host matching: 3 tests for NUL byte and percent-encoded dot behavior against glob-based wildcard policies (NUL causes OPA engine error = fail closed; percent-encoded dot is not decoded)
• SSRF resolution: 2 tests verifying NUL-containing hostnames fail DNS resolution (fail closed at both resolve_and_reject_internal and resolve_and_check_allowed_ips)

Testing

• mise run pre-commit passes
• Unit tests added/updated

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[shaneutt]

I have read the DCO document and I hereby sign the DCO.

[johntmyers]

recheck

[github-actions]

Label test:e2e applied, but pull-request/2197 is at {"messa while the PR head is 8ad6aac. A maintainer needs to comment /ok to test 8ad6aac1790813fed370e9a46e19ff30ef370d77 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

[johntmyers]

gator-agent

PR Review Status

Validation: This PR is project-valid because it implements focused regression coverage for the already validated sandbox/security testing issue #1498.
Head SHA: 8ad6aac1790813fed370e9a46e19ff30ef370d77

Review findings:

• No blocking findings remain.
• Non-blocking reviewer note: several parser tests document current malformed-host pass-through behavior; the important security invariant is fail-closed behavior, which this PR also covers through OPA/SSRF denial-path tests. A future hardening PR can tighten parsing and invert those parser-only assertions.

Docs: Not needed because this is test-only regression coverage with no direct user-facing UX/API change.

E2E: test:e2e is required because the PR touches network proxy and policy-enforcement behavior.

Next state: gator:watch-pipeline

[johntmyers]

/ok to test 8ad6aac

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator had completed review, required test:e2e, and the PR had maintainer approval before merge.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.