PAC 3 - Add Windows system proxy resolver

[canvrno-oai]

Summary

Stacked on #26707.

Adds the Windows implementation of the shared system-proxy contract. This allows Codex-owned auth clients to use the route Windows selects for each auth URL, including explicit PAC configuration, WPAD auto-detection, static proxies, and bypass rules.

The respect_system_proxy feature is disabled by default, so existing client behavior remains unchanged unless explicitly enabled.

Implementation

• Adds Windows-only codex-client dependencies:
  • windows-sys with Win32_Foundation and Win32_Networking_WinHttp;
  • sha2 for redacted cache keys.
• Dispatches system-proxy resolution to outbound_proxy/windows.rs on Windows.
• Reads the current-user WinHTTP/IE proxy configuration via WinHttpGetIEProxyConfigForCurrentUser.
• Resolves explicit PAC URLs first, then OS-enabled WPAD auto-detection, then static proxy and bypass settings.
• Uses WinHttpGetProxyForUrl for PAC/WPAD and maps results into the shared SystemProxyDecision::{Direct, Proxy, Unavailable} contract.
• Parses DIRECT, PROXY, HTTPS, and keyed static proxy entries.
• Treats unsupported schemes such as SOCKS as unavailable so the shared resolver can apply its environment-proxy fallback.
• Handles Windows bypass entries, including <local> and host, suffix, wildcard, and port matching.
• Releases WinHTTP-owned strings with GlobalFree and closes sessions with WinHttpCloseHandle.
• Hashes URL-specific cache keys with SHA-256 so PAC decisions remain URL-specific without retaining raw request URLs or query strings.

End-user behavior

• Disabled/default: existing client behavior is unchanged.
• Enabled with [features.respect_system_proxy]:
  • Windows auth clients honor explicit PAC configuration, OS-enabled WPAD, static proxies, and bypass rules;
  • valid OS/PAC DIRECT decisions use a direct connection;
  • unavailable system resolution falls back to explicit environment proxy variables, then DIRECT, through the shared contract from PAC 2 - Add shared auth system proxy contract #26707.
• Unsupported proxy schemes are not silently translated into a different route.
• Custom CA handling remains separate from proxy selection.

Tests

Adds coverage for:

• PAC-style proxy tokens such as PROXY proxy.internal:8080 and HTTPS proxy.internal:8443;
• static WinHTTP proxy entries keyed by target scheme;
• DIRECT and unsupported proxy-token behavior;
• Windows bypass matching, including <local>, wildcard, suffix, and port-qualified entries;
• preserving URL-specific PAC cache decisions without retaining the raw URL on Windows.

[iceweasel-oai]

(from Codex): Added inline review comments.

[canvrno-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 30866d153a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13cc356ec8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c33069fc0e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".