feat: add domain-based outbound filtering with allowedDomains/deniedDomains

Add NetworkConfig.AllowedDomains and DeniedDomains fields for controlling
outbound connections by hostname. Deny rules are checked first (deny wins).
When AllowedDomains is set, only matching domains are permitted. When only
DeniedDomains is set, all domains except denied ones are allowed.

Implement FilteringProxy that wraps gost HTTP proxy with domain enforcement
via AllowConnect callback. Skip GreyHaven proxy/DNS defaults

internal/sandbox/utils_test.go

@@ -199,6 +199,72 @@ func TestGenerateProxyEnvVars(t *testing.T) {
 	}
 }
 
+func TestGenerateHTTPProxyEnvVars(t *testing.T) {
+	tests := []struct {
+		name         string
+		httpProxyURL string
+		wantEnvs     []string
+		dontWant     []string
+	}{
+		{
+			name:         "no proxy",
+			httpProxyURL: "",
+			wantEnvs: []string{
+				"GREYWALL_SANDBOX=1",
+				"TMPDIR=/tmp/greywall",
+			},
+			dontWant: []string{
+				"HTTP_PROXY=",
+				"HTTPS_PROXY=",
+			},
+		},
+		{
+			name:         "http proxy",
+			httpProxyURL: "http://127.0.0.1:12345",
+			wantEnvs: []string{
+				"GREYWALL_SANDBOX=1",
+				"HTTP_PROXY=http://127.0.0.1:12345",
+				"HTTPS_PROXY=http://127.0.0.1:12345",
+				"http_proxy=http://127.0.0.1:12345",
+				"https_proxy=http://127.0.0.1:12345",
+				"NO_PROXY=",
+				"no_proxy=",
+			},
+			dontWant: []string{
+				"ALL_PROXY=",
+				"all_proxy=",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GenerateHTTPProxyEnvVars(tt.httpProxyURL)
+
+			for _, want := range tt.wantEnvs {
+				found := false
+				for _, env := range got {
+					if strings.HasPrefix(env, want) || env == want {
+						found = true
+						break
+					}
+				}
+				if !found {
+					t.Errorf("GenerateHTTPProxyEnvVars(%q) missing %q", tt.httpProxyURL, want)
+				}
+			}
+
+			for _, dontWant := range tt.dontWant {
+				for _, env := range got {
+					if strings.HasPrefix(env, dontWant) {
+						t.Errorf("GenerateHTTPProxyEnvVars(%q) should not contain %q, got %q", tt.httpProxyURL, dontWant, env)
+					}
+				}
+			}
+		})
+	}
+}
+
 func TestEncodeSandboxedCommand(t *testing.T) {
 	tests := []struct {
 		name    string