safehttp: check the destination of requests sent through a forward proxy #115

safehttp.New clones http.DefaultTransport, which keeps Proxy: http.ProxyFromEnvironment, and the address gate only wraps DialContext. When HTTP_PROXY or HTTPS_PROXY is set, the transport dials the forward proxy instead of the destination, so the gate checks the forward proxy's address and never the destination's. A URL taken from upstream metadata, a redirect or a token realm can then reach a link-local, loopback or private address through the forward proxy, and that applies to every consumer of safehttp.

The fix is to wrap transport.Proxy in newClient beside the dial gate: for a request that goes to a forward proxy, resolve the destination host and run each address through the same checks as the dial, with the same Options. A host that can't be resolved locally should still go to the forward proxy, since some networks only resolve public names there. Direct requests don't change.

git-pkgs/proxy#577 has a working version of this in the proxy's own client, which could move here largely as is.