fix: respect NO_PROXY CIDR notation in Vault CLI HTTP client

[RoySerbi]

What this does

Fixes #31954

When VAULT_HTTP_PROXY or VAULT_PROXY_ADDR is set, the Vault CLI uses http.ProxyURL() which always routes through the proxy regardless of NO_PROXY entries. This means CIDR notation in NO_PROXY (e.g., 10.66.0.0/16) is ignored.

Root cause

In api/client.go, the proxy is configured with:

transport.Proxy = http.ProxyURL(u)

http.ProxyURL returns a function that always returns the given proxy URL, completely ignoring the NO_PROXY environment variable.

Fix

Replace http.ProxyURL() with a custom proxy function that checks NO_PROXY entries before routing through the proxy, supporting:

• Exact hostname matching (localhost)
• Domain suffix matching (.mycompany.tld)
• CIDR subnet matching (10.66.0.0/16)

When a host matches a NO_PROXY entry, the proxy is bypassed (returns nil, nil).

[vercel]

@RoySerbi is attempting to deploy a commit to the HashiCorp Team on Vercel.

A member of the Team first needs to authorize it.

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}