feat(backup): support ndb through http proxy

[ayoub-el-kajji-v]

Description

This PR adds support for using NBD through an HTTP proxy.

Before this change, NBD could be used for continuous VM replication when the source host was directly reachable from XOA, but replication would fall back to a stream export when the source host could only be reached through an HTTP proxy. If CBT data had also been purged, this would result in a full export.

This meant that continuous replication behaved differently depending on how the source host was reached: NBD worked with direct connectivity, but was not available when the connection had to go through an HTTP proxy.

With this change, NBD connections can also be established through an HTTP proxy, allowing continuous replication to use NBD regardless of whether the source host is directly reachable or accessed through a proxy.
[XO-3028]

Tested

Lab reproducing the customer's setup:

• Source pool reachable from XO only through an HTTP proxy (Squid, with Basic auth); direct access from XO to the source hosts blocked with iptables REJECT
• Destination pool reached directly
• Continuous Replication job: NBD enabled (2 connections per disk), CBT with snapshot data purge, no XO Proxy selected

Results:

• NBD connections go through the proxy: Squid logged 2 CONNECT <host>:10809 tunnels (1 disk × 2 NBD connections) that carried the disk data (18 MiB); the 443 tunnels only carried XAPI calls (4.2 MiB)
• No traffic bypassed the proxy: the REJECT counters stayed at 0
• The job log contains no can't connect through NBD, can't compute delta or fell back to a full warning

Checklist

• Commit
  • Title follows commit conventions
  • Reference the relevant issue, forum thread, discussion, ... (Fixes #007, See xoa-support#42, See https://...)
  • If bug fix, add Introduced by <commit|PR>
• Changelog
  • If visible by XOA users, add changelog entry to CHANGELOG.unreleased.md
  • If visible by XO Lite users, add changelog entry to @xen-orchestra/lite/CHANGELOG.md
  • Update "Packages to release" in CHANGELOG.unreleased.md
• PR
  • If UI changes, add a ### Screenshots section above this checklist
  • If not finished or not tested, open as Draft

Review process

• External contributors: simply open the pull request, we'll get back to you as soon as possible.
• Vates developers: follow the internal pull request process.

[plane-sync-vates]

Linked to Plane Work Item(s)

• (XO-3028) [Backup] Support NBD behind HTTP proxy

This comment was auto-generated by Plane

[mpiton]

This hand-parses the proxy reply (buffering, 16 KiB cap, status line). Node's http.request({ method: 'CONNECT' }) already hands back res, socket and head on 'connect'. Could we use it and drop most of this method?

[fbeauchamp]

I agree I think we can slim down this implementation

It can even accept a timeout parameter to ensure any failure to connect is cleared by the OS

[fbeauchamp]

a proxy protocol can also be socks5 (and probably others ) , I think we should throw an eplicit error if we have anything other than http/https , as long as we don't need it