Scope http.proactiveAuth to remote host

What does this MR do and why?

Closes #39471 (closed).

When FF_USE_GIT_PROACTIVE_AUTH is enabled (off by default in the runner, but turned on for all gitlab.com runner shards via https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/6980), the runner adds -c http.proactiveAuth=basic to git clone, git fetch, and git checkout. Because the override is unscoped, Git propagates it to every child process via GIT_CONFIG_PARAMETERS -- including the helper that fetches bundle URIs from third-party signed URLs (storage.googleapis.com/...).

Combined with credential.interactive=never, the bundle-URI helper attempts a credential lookup, can't prompt, and dies before any HTTP request. The parent reports insufficient capabilities and falls back to normal smart HTTP, silently disabling the bundle URI optimization for every job whose Gitaly repo has a bundle.

This MR scopes the config to the remote host (http.<remoteHost>.proactiveAuth=basic). Git's standard urlmatch machinery limits it to requests whose URL starts with the GitLab remote, so the bundle-URI helper no longer triggers the credential lookup. The same pattern is already used in this repo for http.<remoteHost>.sslCAInfo and credential.<remoteHost>.helper.

The fix is applied in both code paths that build clone/fetch/checkout args: shells/abstract.go (legacy) and functions/concrete/run/stages/get_sources.go (concrete runner).

Screenshots or screen recordings

N/A -- silent regression, no visible UI.

How to set up and validate locally

1. Run the targeted unit tests:

   go test ./shells/ -run 'TestGitProactiveAuth|TestProactiveAuthArgs' -count=1 -v go test ./functions/concrete/run/stages/ -run 'TestGetSources_ProactiveAuthArgs' -count=1 -v

2. Inspect the generated git invocations -- they should now contain -c http.https://<host>.proactiveAuth=basic instead of the unscoped form.

3. End-to-end: verified in https://gitlab.com/gitlab-org/gitaly/-/jobs/14576983562.

MR acceptance checklist

• I have evaluated the MR acceptance checklist for this MR.

🤖 Generated with Claude Code