run_command(ignore_env=True) passed the caller's env straight to
subprocess.Popen. Every caller on that path hands it an empty dict, so
openstack-image-manager, openstack-flavor-manager,
openstack-project-manager and everything going through
run_openstack_command_with_cloud started with a completely empty
environment.

That dropped HTTP_PROXY, HTTPS_PROXY and NO_PROXY, so on a manager
without direct outbound connectivity the image manager could not reach
the image sources at all, and the aria2c subprocess it spawns inherited
the same empty environment. REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and
SSL_CERT_FILE were lost with them, and so were PATH, HOME, LANG and TZ.

Build the environment from an allowlist instead: the proxy variables in
both spellings, the CA bundle variables, and PATH, HOME, LANG, LC_* and
TZ are taken from the worker container and the caller's env is overlaid
on top. The OS_* variables of openstack.env stay out, so they still
cannot override the --cloud selection from clouds.yaml.

Replaces test_run_command_ignore_env_passes_env_verbatim, which
asserted that the caller's dict reaches Popen by identity, with tests
covering inheritance of every allowlisted name and the LC_ prefix, OS_*
exclusion, and caller precedence including keys outside the allowlist.

Closes #2682

Assisted-by: Claude:claude-opus-5
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Christian Berendt <berendt@osism.tech>