fix(proxy): normalize trailing-dot CONNECT hosts before policy evaluation

[letv1nnn]

Summary

Fixes inconsistent handling of trailing-dot hostnames (e.g. api.example.com.) in the sandbox supervisor's CONNECT proxy. Such hosts are valid RFC 1034 FQDNs used in Kubernetes ndots:5 environments to bypass search-domain expansion, but were treated as distinct from their undotted equivalents across policy evaluation, middleware selection, and credential matching.

Related Issue

#2201

Changes

• Strip one trailing dot from CONNECT host before policy checks, normalize_connect_host(raw_host: &str) -> &str {...}
• DNS resolvers still get the original dotted form (preserves ndots:5 bypass)
• Unit tests for the normalization helper

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

/ok to test 8384df5