Forward TLS and proxy env vars into SRT sandbox

What does this MR do and why?

Fixes self-managed instances with custom CAs or proxy configurations failing certificate validation inside the sandboxed (SRT) execution environment.

The env -i invocation used to launch the sandboxed process strips all environment variables and only re-injects an explicit allowlist. TLS and proxy variables (NODE_EXTRA_CA_CERTS, NODE_TLS_REJECT_UNAUTHORIZED, HTTP_PROXY, HTTPS_PROXY, NO_PROXY, and their lowercase equivalents) were not on that list, causing certificate validation failures for self-managed customers even when the variables were correctly set at the runner/job level.

Changes:

• Add a TLS_AND_PROXY_ENV_VARS constant to Gitlab::DuoWorkflow::Sandbox listing the TLS/proxy variables that must be forwarded
• Include these in build_env_vars_flags so they are forwarded via variable references (e.g. NODE_EXTRA_CA_CERTS="$NODE_EXTRA_CA_CERTS") — preserving the existing pattern of not embedding values to avoid logging sensitive data
• Add a spec asserting all TLS/proxy variables appear in the unshare command line
• Update the troubleshooting documentation to reflect that these variables are now automatically forwarded

References

Closes #604795 (closed)

Screenshots or screen recordings

N/A — backend-only change

How to set up and validate locally

1. Set NODE_EXTRA_CA_CERTS in the runner's config.toml environment directive
2. Run a Duo Agent Platform flow with sandboxing enabled (privileged runner)
3. Observe that the flow no longer fails with certificate validation errors

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.