refactor(rust): read the proxy environment through hyper-util's matcher

`hyper_util` ships `client::proxy::matcher::Matcher` behind its `client-proxy`
feature: the `*_PROXY` convention including `ALL_PROXY`, `NO_PROXY` matched the
way curl matches it, and credentials taken out of a proxy URL. This crate had
written all of that again, so `resolve_proxy`, `system_proxy`, `read_env_first`
and `no_proxy_matches` are gone, and `system` now means what it means for any
hyper-based client.

Only `system` goes through the matcher. It answers `None` for a target with no
host or a scheme other than `http`/`https`, so routing an explicitly named proxy
through it would silently skip the proxy the caller configured; that path dials
its URI directly, as it did before.

The tunnel stays ours. `hyper_util`'s reads the `CONNECT` response as

    if recvd.starts_with(b"HTTP/1.1 200") || recvd.starts_with(b"HTTP/1.0 200")
    else if recvd.starts_with(b"HTTP/1.1 407") ...
    else return Err(TunnelError::TunnelUnsuccessful)

so a status line split across reads is rejected although the tunnel is good, and
`HTTP/1.0 407` loses its meaning. Ours reads to the blank line before parsing.

`basic_auth` now returns the whole header value, scheme included, so that it and
`Intercept::basic_auth` are interchangeable at the call site. Getting that wrong
sent `Basic Basic <b64>` and was caught by the authentication tests.

Measured, from `packages/rust`:

    $ cargo test -p armonik-transport --all-features
    70 passing

    $ cargo clippy --workspace --all-features --all-targets --no-deps -- -Dwarnings
    $ cargo clippy --workspace --all-features --no-deps \
          -- -Dwarnings -Dunused-crate-dependencies
    $ RUSTDOCFLAGS="-Dwarnings" cargo doc --workspace --no-deps
    $ cargo build --workspace --locked
    $ cargo build -p armonik-transport
    $ cargo fmt --all --check
    all silent

proxy.rs goes from 730 to 611 lines. Prompted by a maintainer asking whether
hyper-util already did this.

Author: wkirschenmann

packages/rust/Cargo.lock

@@ -20,7 +20,9 @@ tonic = { workspace = true, features = ["channel", "codegen"] }
 snafu.workspace = true
 tracing.workspace = true
 hyper = { workspace = true, features = ["client", "http1", "http2"] }
-hyper-util = { workspace = true, features = ["client", "http1"] }
+# `client-proxy` for the proxy matcher: the `*_PROXY` convention, `NO_PROXY` on curl's rules, and
+# taking credentials out of a proxy URL, none of which is worth writing again here.
+hyper-util = { workspace = true, features = ["client", "client-proxy", "http1"] }
 hyper-rustls = { workspace = true, features = [
   "http1",
   "http2",

packages/rust/armonik-transport/Cargo.toml

@@ -15,7 +15,12 @@ pub enum ProxySource {
     /// The default, so that adding proxy support changes nothing for a client that never asked for it.
     #[default]
     Disabled,
-    /// Read the proxy from `HTTPS_PROXY`, `HTTP_PROXY` and `NO_PROXY`, in either case.
+    /// Read the proxy from the environment, on `hyper_util`'s rules: `ALL_PROXY`, `HTTPS_PROXY`,
+    /// `HTTP_PROXY` and `NO_PROXY`, in either case, with `NO_PROXY` matched as curl matches it.
+    ///
+    /// Read when `connect` builds the channel, not when this is built and not again afterwards: a
+    /// variable changed in between is the one that counts, and a channel that reconnects keeps the
+    /// values it started with. Every other option is read in [`ClientConfigArgs::from_env`].
     System,
     /// Use this specific proxy.
     Explicit(Uri),
@@ -213,8 +218,8 @@ pub struct ClientConfigArgs {
     pub user_agent: String,
     /// HTTP proxy to reach the endpoint through.
     ///
-    /// Empty for a direct connection, `none` to disable proxying explicitly, `system` to read
-    /// `HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY` from the environment, otherwise the proxy URL.
+    /// Empty for a direct connection, `none` to disable proxying explicitly, `system` to read the
+    /// environment (see [`ProxySource::System`]), otherwise the proxy URL.
     #[cfg_attr(feature = "serde", serde(default))]
     pub proxy: String,
     /// Username for proxy authentication.