test(sandbox): reject malformed proxy hostnames

[mjamiv]

Summary

• reject malformed CONNECT host authorities before policy/DNS handling
• make OPA network evaluation fail closed for unsafe host strings
• add regression coverage for NUL/control, percent-encoded, slash, and backslash hostname differentials against wildcard policies

Fixes #1498.

Testing

• cargo fmt --all -- --check
• git diff --check
• cargo test -p openshell-sandbox malformed
• cargo test -p openshell-sandbox --lib

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.