refactor(df): rewrite proxy for policy model

Michael Eddingtonrequested to merge
df-mr-04-proxy into main

Rewrites the MITM inspection proxy to the match / policy-check / enforce model. Adds per-ecosystem matchers (npm, pypi, maven, gem) that extract an exact package coordinate from intercepted requests, a fail-closed policy gate in the tunnel loop, and ecosystem-native 403 block responses. Uploads are matched by peeking and restoring the request body so the upstream round trip is unaffected.

Self-contained: depends only on the policy package (landed in the MR below). cilog/summary are untouched here — their trims ride with the fsx MR, since the trim entangles the internal/fsx -> internal/dependencyfirewall/fsx relocation.

Part of the dependency-firewall breakup. Stacked on df-mr-03-policy.

Testing

  • make build
  • go test ./internal/dependencyfirewall/proxy/... (includes the end-to-end MITM proxy test over real TLS: allow/warn/block, fail-closed on checker error, upload body integrity, and PyPI PEP 658 sidecar handling)
  • golangci-lint run ./internal/dependencyfirewall/proxy/... (0 issues)

Merge request reports