network: chain proxy requests via upstream proxy

[gmarmstrong]

Use proxy settings from the buildkitd environment to route requests from BuildKit's internal proxy through the configured upstream proxy. This adds the "double proxy" feature referenced in #6740 (comment).

This PR depends on #6995, which adds FilterProxyEnv. Once #6995 merges, I'll add ALL_PROXY and all_proxy to the shared proxy environment definition and remove some shared helper code from this branch's diff. I'll keep this PR in draft state until then.

Resolves #6991

[TommyLike]

Could the usage of the feature these two PRs add (#6995 + #6996) be documented in docs/proxy.md? A short usage section — how to enable upstream chaining, which buildkitd env vars it reads and their precedence, and the NO_PROXY behavior — would make the whole flow discoverable for users. Happy to send a small docs PR for it; I've been validating this end-to-end against a Squid caching gateway.

[gmarmstrong]

Could the usage of the feature these two PRs add (#6995 + #6996) be documented in docs/proxy.md? A short usage section — how to enable upstream chaining, which buildkitd env vars it reads and their precedence, and the NO_PROXY behavior — would make the whole flow discoverable for users. Happy to send a small docs PR for it; I've been validating this end-to-end against a Squid caching gateway.

I don't believe #6995 needs additional documentation, because the docs already promise what it does. It's more of a bug fix than a feature.

As for this PR, I did add an "Upstream proxies" section already, but I can flesh it out a bit.

[TommyLike]

@gmarmstrong Built the image from this branch and tested it end-to-end against a Squid SSL-bump caching proxy: upstream chaining for RUN steps works, cache hits confirmed on repeat builds, and the system-trust-store approach for the upstream CA (SSL_CERT_FILE) works as designed. No further concerns from our side — hope this can land, as we're building our own build & caching clusters on top of it.