fix(proxy): normalize trailing-dot CONNECT hosts before policy evaluation

[letv1nnn]

Summary

Fixes inconsistent handling of trailing-dot hostnames (e.g. api.example.com.) in the sandbox supervisor's CONNECT proxy. Such hosts are valid RFC 1034 FQDNs used in Kubernetes ndots:5 environments to bypass search-domain expansion, but were treated as distinct from their undotted equivalents across policy evaluation, middleware selection, and credential matching.

Related Issue

#2201

Changes

• Strip one trailing dot from CONNECT host before policy checks, normalize_connect_host(raw_host: &str) -> &str {...}
• DNS resolvers still get the original dotted form (preserves ndots:5 bypass)
• Unit tests for the normalization helper

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

/ok to test 8384df5

[r3v5]

PR: #2248
Author: letv1nnn (Artem Lytvyn)
Branch: 2201-normalize-trailing-dot-host -> main

Overview

Strips trailing dot from FQDN CONNECT hosts (e.g. api.example.com. → api.example.com) before policy evaluation, middleware selection, and credential matching. Fixes mismatches in K8s ndots:5 environments where dotted and undotted forms were treated as distinct hosts.

Key Design Decisions

• Normalize once, early (proxy.rs:613): Single normalize_connect_host() call right after parse_target(), so all downstream policy logic sees the clean hostname.
• Selective raw_host pass-through (proxy.rs:784, proxy.rs:837): resolve_and_check_trusted_gateway and resolve_and_check_allowed_ips still receive raw_host to preserve the ndots:5 DNS bypass
  behavior.

Notable Code

crates/openshell-supervisor-network/src/proxy.rs:4546

fn normalize_connect_host(raw_host: &str) -> &str {
    raw_host.strip_suffix('.').unwrap_or(raw_host)
}

Clean, zero-allocation — returns a sub-slice. Only strips one dot per RFC 1034.

[r3v5]

All good from my side!

[johntmyers]

/ok to test 0ae8014

[github-actions]

Label test:e2e applied for 0ae8014. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

Hosts need to be normalized in the forward-proxy path as well. Currently, non-CONNECT requests are dispatched prior to the normalization. I think if we duplicate the normalization for now that's ok. We're going to refactor the proxy and align CONNECT and non-CONNECT paths under the same code. But to merge this as-is we need to make sure we normalize for both pathways.

[johntmyers]

Also need to normalize hostnames for hosts file (/etc/hosts) lookups and retain the raw_host for DNS.

[johntmyers]

See comments