feat(ns-plug): dual-send backup to my-new proxy

[edospadoni]

Summary

Add a second upload to https://my.nethesis.it/proxy/backup inside send-backup, after remote-backup finishes uploading to the legacy backupd.nethesis.it. Mirrors the transitional pattern already in place for send-heartbeat and send-inventory.

Context

The new my.nethesis.it platform ships a first-class configuration-backup subsystem (ingest on collect, managed reads on backend, S3-compatible storage) — see the referenced issues. During the migration window NethSecurity keeps uploading to the legacy backupd and dual-sends to my-new via a translation proxy (nethinfra role). The proxy accepts the existing system_id:secret Basic Auth pair and translates it into the my-new system_key:system_secret as it forwards the request to collect, so nothing changes on the appliance in terms of UCI config or registration.

What changes

packages/ns-plug/files/send-backup:

• After remote-backup upload completes successfully, if ns-plug.config.type == enterprise the script POSTs the same encrypted blob (via curl --data-binary @$BACKUP.gpg) to https://my.nethesis.it/proxy/backup using HTTP Basic auth with system_id:secret from UCI.
• X-Filename is propagated so the user-facing filename ends up as S3 object metadata on my-new.
• The proxy call is best-effort (|| :): a proxy outage does not block the primary upload already completed against backupd, and the md5 marker is still updated so the same backup is not re-uploaded the next night.

Same guard style as the other dual-send scripts — enterprise-only, same -m 900 --retry 3 -L -s curl flags.

Not included

• Rewriting the legacy upload path — out of scope; happens in a later cycle once the new platform is promoted.
• MY registration on the appliance — not needed: the proxy absorbs the credential difference.

Refs: NethServer/my#82 NethServer/my#83