fix(git)!: use internal proxy for all git operations (#39426)

Introduces gitproxy module which spawns a small forward proxy as scanner
for git calls
Replaces hostmatcher with matchlist which supports port rules
Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS
settings in migration in favor of full names we have in security
configs.
Removes `external` preset in favor of lax/strict modes, strict mode
requiring explicit ports if they aren't standard http/s ones.

Breaking changes:
- `external` preset no longer works as deny rule. To enforce that, use
`strict` mode and allow ranges to connect to
- Wildcards are no longer accepted in IP addresses
- `*` is no longer allowed as entry in lists
- domain rules now use curl like syntax `*.example.com` matching
subdomains but not `example.com`, `example.com` matching itself and all
subdomains. `example.*` is not a valid rule
- In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer
restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive
list. A startup warning flags this
- Invalid list entries are logged at startup, invalid
`BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it

Docs: https://gitea.com/gitea/docs/pulls/557
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/auth/openid/openid.go

@@ -8,9 +8,7 @@ import (
 	"sync"
 	"time"
 
-	"gitea.dev/modules/hostmatcher"
-	"gitea.dev/modules/proxy"
-	"gitea.dev/modules/setting"
+	"gitea.dev/modules/egress"
 
 	"github.com/yohcop/openid-go"
 )
@@ -26,15 +24,11 @@ var (
 	nonceStore     = openid.NewSimpleNonceStore()
 	discoveryCache = newTimedDiscoveryCache(24 * time.Hour)
 
-	// openIDInstance does discovery/verification via an SSRF-protected client, so a user-supplied
-	// OpenID identifier can't reach internal/loopback/reserved addresses. It honors the operator's
-	// [security] ALLOWED_HOST_LIST (empty defaults to "external"), matching the avatar/webhook/migration
-	// clients, and validates the proxy path too. Lazy: reads proxy/settings once.
+	// openIDInstance keeps user-supplied OpenID identifiers within [security] ALLOWED_HOST_LIST
 	openIDInstance = sync.OnceValue(func() *openid.OpenID {
-		allowList := hostmatcher.ParseHostMatchList("security.ALLOWED_HOST_LIST", setting.Security.AllowedHostList)
 		return openid.NewOpenID(&http.Client{
 			Timeout:   30 * time.Second,
-			Transport: hostmatcher.NewHTTPTransport("openid", allowList, nil, proxy.Proxy(), setting.Proxy.ProxyURLFixed, nil),
+			Transport: egress.NewSecurityPolicy("openid").NewHTTPTransport(),
 		})
 	})
 )