[WSLC] Reapply "[WSLC] Add cooperative HTTP/HTTPS proxy support"

[Soham Das (SohamDas2021)]

This reverts commit ea8f405, restoring the WSLC cooperative HTTP/HTTPS proxy support originally added in #652.

📖 Description

🔗 References

🔍 Validation

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Restores cooperative HTTP/HTTPS proxy support for WSLC while sharing proxy environment handling with Bubblewrap.

Changes:

• Adds WSLC proxy validation and environment injection.
• Introduces shared proxy-variable sanitization and redaction.
• Adds functional tests and documentation.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
tests/scripts/run_wslc_proxy_test.ps1	Adds WSLC proxy E2E test.
tests/scripts/run_wslc_all_tests.ps1	Runs the proxy fixture.
tests/configs/wslc_network_proxy.json	Defines proxy test configuration.
src/core/wxc_common/src/proxy_env.rs	Adds shared proxy environment helpers.
src/core/wxc_common/src/lib.rs	Exports proxy helpers.
src/core/wxc_common/src/config_parser.rs	Validates WSLC proxy configurations.
src/backends/wslc/common/src/wsl_container_runner.rs	Injects proxy environment variables.
src/backends/bubblewrap/common/src/bwrap_command.rs	Reuses shared proxy helpers.
sdk/node/src/types.ts	Documents SDK proxy constraints.
docs/wsl/wsl-container-getting-started.md	Documents WSLC proxy usage.
docs/schema.md	Notes WSLC URL-form support.

Comments suppressed due to low confidence (1)

docs/wsl/wsl-container-getting-started.md:251

• Node's built-in https module does not honor these variables by default; it requires NODE_USE_ENV_PROXY=1/--use-env-proxy on supported Node versions (or a custom proxy agent). Listing it alongside clients that work without extra opt-in will lead users to expect traffic to be proxied when it is not.

2. Cooperative tools (curl, wget, Python `requests`, Node `https`, etc.) honor
   the env vars and their traffic flows through the proxy.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

src/core/wxc_common/src/config_parser.rs:490

• This validation is not WSLC-specific: convert_wire_proxy runs before the containment checks, so it newly rejects non-HTTP URL schemes for ProcessContainer, Bubblewrap, and Seatbelt too. That contradicts the new types.ts documentation, which lists the scheme restriction under “WSLC imposes additional parse-time constraints,” and changes the behavior of existing backends in a WSLC restoration PR. Either move this check into the WSLC branch or document and validate the cross-backend API change explicitly.

        let scheme = parsed.scheme();
        if scheme != "http" && scheme != "https" {
            // Redact any embedded userinfo (`user:password@`) before it reaches
            // the diagnostic/log stream — a proxy URL commonly carries basic-auth
            // credentials, and the scheme alone diagnoses the failure.
            let redacted = crate::proxy_env::redact_proxy_url(&url_str);
            return Err(WxcError::ConfigParse(format!(
                "network.proxy.url must use the 'http' or 'https' scheme (got '{scheme}'): {redacted}"

src/core/wxc_common/src/config_parser.rs:995

• This error is internally contradictory: it says the host lists are enforced by the proxy while also saying they are not forwarded to it. The external proxy cannot enforce MXC's lists unless the user configures equivalent policy there, so the message should direct users to configure host filtering on the proxy instead.

            let msg = "WSLc: network.proxy requires network.defaultPolicy='allow' and no \
                       allowedHosts/blockedHosts. A WSLc container reaches the proxy only \
                       with outbound networking enabled, and host lists are enforced by the \
                       proxy, not forwarded to it.";

docs/wsl/wsl-container-getting-started.md:244

• The detailed behavior description omits ALL_PROXY/all_proxy, although PROXY_SET_KEYS injects both and caller-supplied values are scrubbed. This matters to consumers because enabling the feature overwrites those variables too; list all six injected keys (or say “and their lowercase variants, including ALL_PROXY”) so the documented environment contract matches the implementation.

1. When `network.proxy` is set, the runner translates it into the
   `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, and `https_proxy` environment
   variables inside the container (via `WslcSetProcessSettingsEnvVariables`).
   Any caller-supplied values for these keys — including `NO_PROXY` /
   `no_proxy` — are **stripped** from the *initial* process environment first.