Draft: POC feat(df): add GitLab Dependency Firewall (glab df) command set

What does this MR do and why?

Adds a new top-level glab df (Dependency Firewall) command set that routes npm operations through GitLab's Dependency Firewall and reports blocked or flagged packages.

The existing Dependency Firewall lives in the gitlab-org/gitlab repository; this MR adds the client-side glab tooling to drive it.

Commands

• glab df npm-config — write npm resolve/deploy repository names to .gitlab/df/config.json (create-or-merge; only the flags you pass are updated, unknown keys are preserved).
• glab df npm -- <npm args> — run the npm binary with its registry pointed at the GitLab Dependency Firewall, behind a localhost MITM proxy that inspects responses. Blocked (HTTP 403) and flagged (2xx + firewall warning signal) packages are recorded to .gitlab/df/ci-log.json and summarized after the run. npm's exit code is propagated.
• glab df ci-summary — render the recorded CI log.

All three commands are marked EXPERIMENTAL.

How it works

glab df npm temporarily rewrites the project .npmrc (backing up the original to .gitlab.npmrc.backup), points npm at https://<host>/api/v4/projects/<repo>/packages/npm/, and runs npm with HTTP(S)_PROXY set to an in-process MITM proxy on 127.0.0.1. The proxy generates an in-memory CA and per-host leaf certs; npm runs with strict-ssl=false so no CA trust installation is needed. The original .npmrc is restored on completion and on SIGINT/SIGTERM so an interrupted install never leaves the repo's .npmrc modified or the backup behind.

Architecture

• Engine packages (logic, no cobra) under internal/dependencyfirewall/: verdict, config, npmrc, cilog, summary, proxy.
• Thin command packages under internal/commands/df/.
• Registered in internal/commands/root.go; docs generated under docs/source/df/.

Security considerations

The MITM proxy's InsecureSkipVerify and strict-ssl=false apply only to the npm subprocess (via per-exec env and a temporary .npmrc) — never to glab's own GitLab API client. The CA is in-memory, process-scoped, and expires in 24h. The auth token is written only into .npmrc (the standard npm mechanism) and is never logged or recorded in the CI log.

Testing

• Unit tests for every engine and command package (TDD throughout), including:
  • byte-identical .npmrc restore (success and npm-failure paths),
  • end-to-end MITM proxy test over real TLS, including a gzipped warning body,
  • npm exit-code mapping.
• make lint is clean (0 issues); docs are in sync with make gen-docs.

Related issues

• https://gitlab.com/gitlab-org/gitlab/-/work_items/603648+s

Author checklist

• Tests added/updated
• Documentation regenerated (make gen-docs)
• Lint clean